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COMMITTEE ON THE SAFETY OF NUCLEAR INSTALLATIONS 


The Committee on the Safety of Nuclear Installations (CSNI) shall be responsible for NEA programmes 
and activities that support maintaining and advancing the scientific and technical knowledge base of the 
safety of nuclear installations, with the aim of implementing the NEA Strategic Plan for 2017-2022 in its 
field of competence. 

The Committee shall constitute a forum for the exchange of technical information and for collaboration 
between organisations, which can contribute, from their respective backgrounds in research, development 
and engineering, to its activities. It shall have regard to the exchange of information between member 
countries and safety R&D programmes of various sizes in order to keep all member countries involved in 
and abreast of developments in technical safety matters. 

The Committee shall review the state of knowledge on important topics of nuclear safety science and 
techniques and of safety assessments, and ensure that operating experience is appropriately accounted for 
in its activities. It shall initiate and conduct programmes identified by these reviews and assessments in 
order to confirm safety, overcome discrepancies, develop improvements and reach consensus on technical 
issues of common interest. It shall promote the co-ordination of work in different member countries that 
serve to maintain and enhance competence in nuclear safety matters, including the establishment of joint 
undertakings (e.g. joint research and data projects), and shall assist in the feedback of the results to 
participating organisations. The Committee shall ensure that valuable end-products of the technical reviews 
and analyses are provided to members in a timely manner, and made publicly available when appropriate, 
to support broader nuclear safety. 

The Committee shall focus primarily on the safety aspects of existing power reactors, other nuclear 
installations and new power reactors; it shall also consider the safety implications of scientific and 
technical developments of future reactor technologies and designs. Further, the scope for the Committee 
shall include human and organisational research activities and technical developments that affect nuclear 
safety. 

The Committee shall organise its own activities. Furthermore, it shall examine any other matters 
referred to it by the Steering Committee. It may sponsor specialist meetings and technical working groups 
to further its objectives. In implementing its programme, the Committee shall establish co-operative 
mechanisms with the Committee on Nuclear Regulatory Activities in order to work with that Committee 
on matters of common interest, avoiding unnecessary duplications. 

The Committee shall also co-operate with the Committee on Radiological Protection and Public Health, 
the Radioactive Waste Management Committee, the Committee for Technical and Economic Studies on 
Nuclear Energy Development and the Fuel Cycle, the Nuclear Science Committee, and other NEA 
committees and activities on matters of common interest. 
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FOREWORD 


Structural integrity of piping systems is important for plant safety and operability. In recognition of this, 
information on degradation and failure of piping components and systems is collected and evaluated by 
regulatory agencies, international organisations (e.g. the Nuclear Energy Agency [NEA] and the 
International Atomic Energy Agency [IAEA]) and industry organisations worldwide. This information is 
often used to provide systematic feedback to reactor regulation and research and development programmes 
associated with non-destructive examination (NDE) technology, in-service inspection (ISI) Programmes, 
leak-before-break evaluations, risk-informed ISI, and probabilistic safety assessment (PSA) applications 
involving passive component reliability. 

Several Organisation for Economic Co-operation and Development (OECD) member countries have 
agreed to establish the NEA Component Operational Experience, Degradation and Ageing Programme 
(CODAP) to encourage multilateral co-operation in the collection and analysis of data relating to 
degradation and failure of metallic piping and non-piping metallic passive components in commercial 
nuclear power plants. The scope of the data collection includes service-induced wall thinning, part 
through-wall cracks, through-wall cracks with and without active leakage, and instances of significant 
degradation of metallic passive components, including piping pressure boundary integrity. The NEA 
Committee on the Safety of Nuclear Installations (CSNI) acts as an umbrella committee of the Project. 

CODAP is the continuation of the 2002-2011 OECD/NEA Pipe Failure Data Exchange Project 
(OPDE) and 2006-2010 NEA Stress Corrosion Cracking and Cable Ageing Project (SCAP). OPDE was 
formally launched in May 2002. Upon completion of the Third Term (May 2011), the OPDE project was 
officially closed to be succeeded by CODAP. SCAP was enabled by a voluntary contribution from Japan. 
It was formally launched in June 2006 and officially closed with an international workshop held in Tokyo 
in May 2010. The majority of the member organisations of the two projects were the same, often being 
represented by the same person. In May 2011, thirteen countries and economies signed the CODAP First 
Term (2011-2014) agreement (Canada, Czech Republic, Finland, France, Germany, Korea (Republic of), 
Japan, Slovak Republic, Spain, Sweden, Switzerland, Chinese Taipei and United States). In December 
2014, eleven countries and economies (Canada, Czech Republic, France, Germany, Korea (Republic of), 
Japan, Slovak Republic, Spain, Switzerland, Chinese Taipei and United States of America) agreed to enter 
into an agreement for the CODAP Second Term (2015-2017). The CODAP Second Term work plan 
includes tasks to prepare topical reports to foster technical co-operation and to deepen the understanding of 
national differences in ageing management. 

This third topical report is concerned with the effectiveness of pressure boundary component 
reliability and integrity management (RIM). Specifically, this report addresses operating experience 
insights related to less-than-adequate (LTA) RIM and its potential safety and operational impacts. The term 
LTA-RIM is defined as events where degradation has progressed beyond acceptable limits in systems, 
structures or components (SSCs) that have a RIM Programme. These LTA-RIM events have some safety 
significance. In this topical report the LTA-RIM definition is broadened to also include events where a 
RIM Programme has resulted in a false positive; that is, it has identified degradation that either didn’t exist 
or was not close to violating acceptance criteria. While such events needlessly expend resources and could 
be considered LTA-RIM from an economic perspective, they do not have any safety significance. 

Additionally, this report addresses selected international practices with respect to pressure testing, 
leak detection, ISI including NDE, and performance demonstration initiatives to improve the reliability of 
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NDE techniques. The purpose of integrity management is to prevent the occurrence of piping through-wall 
leaks as well as to monitor passive metallic component degradation. RIM Programme utilises risk insights 
to augment or enhance existing deterministic integrity management programme. Through a systematic 
examination of the operating experience as recorded in the CODAP event database, the field experience 
with the different RIM strategies is evaluated in order to draw qualitative and quantitative insights about 
integrity management reliability. This topical report also includes an introduction of an approach to 
evaluate the effect of different integrity management strategies on pressure boundary component 
reliability. 

The CODAP event database includes numerous records where degraded or failed conditions are 
attributed to LTA implementation of RIM, including NDE. Especially noteworthy are some recent 2010 - 
2016 occurrences of passive component degradation or failure that are attributed in part to LTA 
implementation of RIM. When RIM failures occur, one or more of the following factors are often present: 

• Accepting a rejectable flaw indication for continued operation. This could be due to 
misinterpretation of NDE results. 

• Rationalising away detected defects. 

• Using improperly qualified NDE technique. 

• Poorly implementing qualified procedures. 

• Poorly implementing owner-defined inspection programme. 

• Missing a flaw with a qualified procedure. A procedure may not sufficiently document the basis 
for the examination details used to inspect for a specific, previously observed degradation 
mechanism. There may also be inadequate administrative controls for augmented inspections 
and disposition of inspection results. 

Based on the results of an evaluation of the CODAP database content, the number of through-wall 
leakages could be decreased by the following actions: 

• Utilising properly qualified UT techniques. 

• Periodically reviewing and independently validating UT-scanning grids used in inspection of 
piping components. 

• Optimising the ISI programme on the basis of probabilistic RIM methods. 

The report has been prepared by the CODAP Project Review Group (PRG), with technical support 
from the CODAP Operating Agent. 
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1. INTRODUCTION 


Since 2002, the NEA has operated an event database project that collects information on passive metallic 
component degradation and failures. The scope of the database includes primary system piping 
components, reactor pressure vessel internals, main process and standby safety systems, and support 
systems (i.e. American Society of Mechanical Engineers (ASME ) Code Class 1, 2 and 3, or equivalent) 
components, as well as non-safety-related (non-Code) components whose degradation or failure can have 
significant operational impact. With an initial focus on piping systems components (the OPDE Project), the 
scope of the project in 2011 was expanded to also address the reactor pressure vessel and internals as well 
as certain other metallic passive components that are susceptible to damage or degradation. In recognition 
of the expanded scope, the Project Review Group (PRG) approved the transition of OPDE to a new, 
expanded Component Operational Experience, Degradation and Ageing Programme (CODAP). The 
CODAP 2011-2014 and 2015-2017 work programme include the preparation of topical reports to foster 
technical co-operation and to deepen the understanding of national differences in-plant ageing 
management. 

This report represents the third CODAP topical report and focuses on the effectiveness of reliability 
and integrity management (RIM) programme. Through an examination of the operating experience as 
recorded in the CODAP event database, the field experience with the different RIM strategies is evaluated 
in order to draw qualitative and quantitative insights about the effectiveness of RIM to ensure pressure 
boundary component reliability. Throughout this report the term “RIM” is used broadly to describe all 
processes that are in place to monitor the structural integrity of reactor components. 

1.1 Background and related work 

Structural integrity of piping components and systems and non-piping passive components such as the 
reactor pressure vessel and internals is important for plant safety and operability. In recognition of this, 
information on degradation and failure of metallic piping and non-piping passive components is collected 
and evaluated by regulatory agencies, international organisations (e.g. NEA and IAEA) and industry 
organisations worldwide. This information is used to provide systematic feedback, for example, to reactor 
regulation and research and development programme associated with ageing phenomena, non-destructive 
examination (NDE) technology, in-service inspection (ISI) programme, leak-before-break evaluations, 
risk-informed ISI, and probabilistic safety assessment (PSA) applications involving passive component 
reliability. 

Assessment of passive component service experience data has been an integral element of regulatory 
and industry programme to address long-term operation and nuclear plant licence renewal. Examples of 
programme addressing long-term operations include the Proactive Materials Degradation Assessment 
(PMDA), Expanded Materials Degradation Assessment (EMDA), Generic Ageing Lessons Learned 
(GALL), GALL for Subsequent Licence Renewal (SLR) and International Generic Ageing Lessons 
Learned (IGALL) 1 . A common feature of these 4 programmes is the acknowledgement of systematic 


1. Detailed information on PMDA, EMDA and GALL are available at www.nrc.gov . The IGALL is summarized in IAEA- 
TECDOC-1736 (April 2014), which is available at www.iaea.org . 
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reviews of the accumulated service experience data as one of several inputs to the development of a 
technical basis for practical ageing management of metallic passive components. 

In parallel with the efforts to evaluate service experience data and to correlate the occurrence of 
material degradation with piping design and operational parameters, initiatives have been presented to 
establish an international forum for the systematic collection and exchange of service experience data on 
piping. Since May 2002, the NEA has operated the OPDE/SCAP-SCC/CODAP database projects under the 
co-ordination of the Committee on the Safety of Nuclear Installations (CSNI). The first term of the OPDE 
Project covered the years 2002-2005; the second term covered the period 2005-2008; and the final term 
covered the period 2008-2011 [1], 

In May 2011 the PRG approved the transition of OPDE to a new, expanded NEA CODAP. A first 
CODAP National Co-ordinators Meeting was held at NEA Headquarters in November 2011. The CODAP 
Project builds on the success of OPDE and a related NEA data project, the SCAP SCC Working Group. In 
December 2014 the PRG approved the programme plan for a second term (2015-2017). 

In 2006 the Stress Corrosion Cracking and Cable Ageing Project (SCAP) was established under the 
auspices of the NEA to assess two subjects: stress corrosion cracking (SCC) and degradation of cable 
insulation. The project ran successfully from June 2006 to June 2010. SCAP was financed through a 
voluntary Japanese contribution to the NEA. Fourteen NEA member countries joined the SCAP in 2006 to 
share knowledge and by 2010, seventeen countries had joined the project. The International Atomic 
Energy Agency (IAEA) and the European Commission, through its Joint Research Centre in Petten, also 
participated as observers. The general objective of the SCAP co-ordinated project was to share corporate 
knowledge and operating experience, to understand the failure mechanisms, and to identify effective 
techniques and technologies to effectively manage and mitigate active degradation in nuclear power plants. 
The specific objectives of the project were to: 

• Establish a database of major ageing phenomena for SCC and degradation of cable insulation 
through the collective efforts of NEA members. 

• Establish a knowledge base of these topics by compiling and evaluating the collected data and 
information systematically. 

• Perform an assessment of the data and identify the basis for commendable practices to help 
regulators and operators enhance ageing management Programme. 

The scope of the SCAP SCC Working Group activities covered class 1 and 2 pressure boundary 
components, reactor pressure vessel internals and other components, but excluded steam generator tubing. 
The entire SCC database consisted of an event database and general information. The general information 
consisted of regulations and codes and standards; inspection, monitoring, and qualification requirements; 
preventative maintenance and mitigation strategies, repair and replacement actions; safety assessment; and 
R&D. This cumulative information comprised the knowledge base [2], 

Following the completion of the SCAP project, SCC Working Group participants were interested in 
some form of continuation and discussions were initiated to explore possible alternatives. It was recognised 
that there were many interests very similar to those existing in OPDE and the concept of a new project was 
envisaged to combine the two projects into the CODAP. The objective of CODAP is to collect information 
on passive metallic component degradation and failures of the primary system, reactor pressure vessel 
internals, main process and standby safety systems, and support systems (i.e. ASME Code Class 1, 2 and 3, 
or equivalent). It also covers non-safety-related (non-Code) components with significant operational 
impact [3] [4] [5], 

The CODAP event database resides on a secure server at NEA Headquarters. Provisions exist for 
online data submission and database interrogation (e.g. event review, QA, queries) as well as downloading 
queries (in CSV- or XML-file format) and selected event records or the entire database (in XML-file 
format ) to a local computer or computer network. 
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The CODAP-PRG membership consists primarily of nuclear regulatory agencies and their technical 
support organisations (TSOs). Two nuclear utility organisations are also actively engaged in the CODAP 
Project work; Electricitc de France (EDF) and Slovenske Elektrarne (SEAS). 

Apart from recognising the intrinsic value of exchanging operating experience data and related root 
cause analysis results and insights, an important motivation for supporting the international database 
collaboration in 2002 was embedded in the then emerging trend towards risk-informed regulation, 
including risk-informed in-service inspection (RI-ISI). An area of specific interest at the time was 
concerned with the technical basis for performing pipe failure probability analysis in support of RI-ISI 
Programme development. The potential synergies between a comprehensive database such as CODAP and 
the development of statistical passive component reliability models have been explored in multiple 
database application projects 2 . These reliability models include provisions for incorporation of RIM 
effectiveness factors that are based on either expert judgement or on observed field experience data 
including RIM performance demonstration testing results. The CODAP third topical report specifically 
addresses RIM effectiveness and the qualitative and quantitative insights that are derived from ISI histories 
and root cause analysis results as captured in the CODAP event database. 

During 2005-2008 the European Commission Joint Research Centre (EC-JRC) Petten and the NEA 
organised the co-ordinated risk-informed ISI methodologies benchmark (RISMET) study [6] [7]. RISMET 
was a unique comparative study of various approaches to set up an ISI Programme. One of several 
technical aspects of RI-ISI Programme development addressed by RISMET included the probability of 
detection (POD) and how the different RI-ISI methodologies account for the effects of probability of flaw 
detection on an inspection scope. 

1.2 Objectives and scope 

The third topical report is concerned with the effectiveness of pressure boundary component RIM 
processes and lessons learnt from field experience. In this report the term “RIM” accounts for all 
Programmatic, organisational and technological elements that exist to ensure the integrity of reactor 
components. Specifically, the report addresses current international practices with respect to pressure 
testing, leak detection, ISI including risk-informed in-service inspection, NDE, and qualifications to 
various standards to improve the reliability in NDE techniques. RIM Programmes are designed to prevent 
the occurrence of piping through-wall leaks as well as to monitor passive metallic component degradation. 

Through a systematic examination of the operating experience as recorded in the CODAP event 
database, the field experience with the different RIM strategies is evaluated in order to draw qualitative and 
quantitative insights about integrity management effectiveness. The CODAP event database documents the 
international operating experience with metallic passive components. Specifically, the database is 
concerned with degradation and failure of metallic passive components, including the implied or observed 
safety and operational impacts. As such, the database is concerned with the root cause of degradation and 
failure. Less-than-adequate (LTA) implementation of RIM is one important underlying cause of some of 
the observed degradation and failure events. In this report, LTA-RIM is defined as events where 
degradation has progressed beyond acceptable limits in systems, structures or components (SSCs) that 
have a RIM Programme. These LTA-RIM events have some safety significance. In this topical report the 
LTA-RIM definition is broadened to also include events where a RIM Programme has resulted in a “false 
positive”; that is, it has identified degradation that either didn’t exist or was not close to violating 
acceptance criteria. While such events needlessly expend resources and could be considered LTA-RIM 
from an economic perspective, they do not have any safety significance. Included in this topical report is 


2. Appendix A includes an OPDE/CODAP bibliography that identifies selected database applications that have been 
performed or sponsored by the OPDE/CODAP member organisations. 
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an evaluation of the effect of different RIM strategies on pressure boundary component reliability. In 
summary, the objectives of the topical report are to: 

• Define passive component RIM and its relationship with existing codes and standards for ISI 
and non-destructive examination (NDE) practices (Section 1.3). 

• Describe the evolution of RIM strategies relative to long-term nuclear power plant operation 
(Section 2). 

• Provide a summary of the Programmatic and technological facilities that are in place to ensure 
a high degree of passive component structural integrity and the steps taken to prevent through- 
wall flaws from developing in metallic safety-related and non-safety-related piping 
components. Included in this summary is a comparison of the different national practices and 
regulations with respect to RIM (Section 2). 

• Perform a systematic evaluation of the field experience data in the CODAP event database to 
identify the types of RIM performance deficiencies that have contributed to failures in 
preventing relatively benign degraded structural conditions to develop into more serious 
structural integrity conditions (Section 3). 

• Explore the RIM performance data in CODAP with respect to quantitative piping reliability 
and operability determinations of degraded conditions. Included in this exploratory aspect of 
the topical report is an examination of the technical basis for analysing the effect of different 
RIM strategies on the predicted passive component reliability (Section 4). 

• Provide an introduction to how to evaluate of the effect of different integrity management 
strategies on pressure boundary component reliability (Section 5). 

• Identify potential improvements to the CODAP event database structure to better capture the 
influences of RIM on passive component degradation and failure. Any recommended 
improvements will be taken into consideration when implementing future enhancements to the 
web-based event database (Section 6.3). 

The scope of this study is limited to evaluations of passive component field experience data as 
documented in the CODAP event database. Specifically, the evaluations address the role of leak detection, 
NDE, visual examination and pressure testing in preventing or mitigating passive component degradation 
and failure. The CODAP event database includes ISI histories and root cause analysis results from which 
RIM performance issues are extracted. 

1.3 Nomenclature 

RIM involves those aspects of a plant design process that are applied to provide an appropriate level of 
reliability of SSCs and a continuing assurance over the life of the plant that such reliability is maintained 
[8]. These include design features important to reliability performance such as design margins, selection of 
materials, testing and monitoring, provisions for maintenance, mitigation of degradation processes, repair 
and replacement, leak monitoring, pressure and leak testing, and ISI. In the context of the ASME Boiler 
and Pressure Vessel Code Section XI, “Rules for In-service Inspection of Nuclear Power Plant 
Components” (ASME XI) [9], RIM is an extension of ISI and is performance-based for NDE and online 
monitoring of structural integrity using advanced technologies such as acoustic monitoring or guided 
ultrasonic waves. In this report the term “RIM” is used broadly to describe all processes that are used to 
monitor the structural integrity of reactor components. A database like CODAP provides vital technical 
input to RIM. 

The development of a RIM Programme may involve applications of risk-informed passive component 
reliability models in which explicit consideration is made of the available body of field experience data on 
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metallic passive components. Implicit consideration also is given to analytical insights from deterministic 
and probabilistic fracture mechanics evaluations that address crack growth (e.g. time for an initial non- 
through-wall crack to grow through-wall) and probability of pipe break given a pre-defined pipe flaw. A 
statistical model of piping reliability is expressed by: 

Pix=^ J ^ik P ( R x\ F ik) I ik ( 1 . 1 ) 

k 


Where: 


Pix = 
^ik = 

P(Rx\F ik ) = 


Frequency of pipe failure of component type i with break size x, subject to epistemic 
uncertainty calculated via Monte Carlo simulation 

Failure rate per location-year for pipe component type i due to failure mechanism k, 
subject to epistemic uncertainty determined by Bayes method 

Conditional rupture probability (CRP) of size x given failure of pipe component type i due 
to damage or degradation mechanism k , subject to epistemic uncertainty 

Integrity management factor for weld type i and degradation mechanism k, subject to 
epistemic uncertainty which may be determined by Monte Carlo simulation and Markov 
model 


In the above equation the integrity management factor accounts for the probability of a certain RIM 
Programme to successfully identify degradation before the degradation has eroded the safety margin of the 
pipe to unacceptable levels. The integrity management factor can be determined on the basis of RIM 
qualification data, expert judgement or field experience data such as that contained in the CODAP event 
database. This model of piping reliability enables a quantitative assessment of the level of risk reduction 
that is achievable with 1ST 

Section XI (“Rules for In-Service Inspection of Nuclear Power Plant Components”) of the ASME 
boiler and pressure vessel code (BPVC) was first issued in 1971 [10]. The philosophy of ASME XI was to 
deterministically mandate a sufficient number of examinations and pressure tests to provide assurance that 
the original safety that was designed and built into the plant is maintained throughout its service life. The 
ASME Code provides requirements for examination, testing, and inspection of components and systems, 
and repair/replacement activities in a nuclear power plant. The mandatory Appendix VIII of ASME 
Section XI provides requirements for performance demonstration (PD) for ultrasonic examination 
procedures, equipment, and personnel used to detect and size flaws. When ASME Section XI was first 
issued in 1971, the ultrasonic inspection techniques specified were adapted from manufacturing practices 
and were based on previous experience with fatigue cracking. The ultrasonic examination rules were 
prescriptive and had not been evaluated on nuclear reactor service-induced degradation mechanisms. The 
reliability of the NDE that were specified by Section XI was not quantified via testing. Instead, the initial 
premise of Section XI was that reliable ultrasonic testing (UT) could be ensured through detailed rules. 

Based on early field experience, the failure of ISI to detect cracks before developing into leaks raised 
concerns regarding the effectiveness of UT being conducted at nuclear power plants and showed that 
improvements in inspection requirements were needed [11]. In response, the US Nuclear Regulatory 
Commission (NRC) sponsored R&D to assess NDE reliability. This research showed that prescriptive 
requirements could not be written to sufficiently accommodate the diversity of power plant materials, field 
conditions, and material degradation processes typically encountered. It was subsequently decided that a 
performance-based testing approach would be the most effective means for achieving the needed 
improvements in NDE reliability. 

In 1989, ASME Section XI adopted a performance-based philosophy that relied on the qualification of 
UT procedures, equipment, and personnel to detect and size flaws in piping and vessels. These new 
requirements were incorporated into Section XI in the mandatory Appendix VIII, titled “Performance 
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Demonstration for Ultrasonic Examination Systems.” In 1991 the many of the US utilities and several 
international utilities formed the Performance Demonstration Initiative (PDI) to implement the then current 
performance demonstration requirements of the ASME Code, Section XI, Appendix VIII “Performance 
Demonstration for Ultrasonic Examination Systems” [12]. The PDI designated the Electric Power 
Research Institute (EPRI) Non-destructive Examination Centre to be the performance demonstration 
Administrator (PDA). 

Division 1 of ASME XI applies to existing light water reactor (LWR) designs. Building on insights 
from the implementation of RI-ISI during 1995 to the present time, as well as on ISI requirements for new 
Gen-III+ and Gen-IV reactor designs, a new Division 2 of ASME XI is under development. The new 
Division 2 applies a risk-informed approach to the development and implementation of RIM. Of note is 
that the new Division 2 of the ASME Code is intended to apply to license extension for operating NPPs 
from 60 to 80 years of operation and even for non-nuclear complex engineered systems [13]. 

1.4 Disclaimer 

The CODAP Project places strong emphasis on data quality, including the completeness and 
comprehensiveness of recorded events. Data quality is achieved through a formal validation process as 
articulated in a Coding Guideline. The roles and responsibilities with respect to data submissions and data 
validation are defined in the CODAP Operating Procedures. Section 3 of this report includes high-level 
database summaries with respect to RIM and its importance relative to mitigation or prevention of passive 
component material degradation. In the high-level data processing the term “less-than-adequate RIM” 
(LTA-RIM) is used to address deficiencies in RIM processes 3 to prevent or mitigate material degradation, 
or to identify recordable or rejectable flaws before exceeding acceptance criteria for continued operation. 
The results of the data processing and analysis that are presented herein are based as much as possible on 
the results of root cause analyses. The writing team for this topical report has not performed any re¬ 
assessments of the findings related to RIM process deficiencies as documented in the root cause analysis 
reports that are embedded in the CODAP Event Database. 

The CODAP-PRG is fully aware of the fact that the full root cause analysis documentation as 
prepared by an owner/operator or its subject matter experts is not normally disseminated outside the 
industry. The CODAP Coding Guidelines includes instructions for what “root cause information” to 
include in the database. As a guiding principle, the instructions provided state that any relevant information 
on a cause-consequence relationship is to be included. Respective National Coordinator assumes 
responsibility for the accuracy on the technical information that is input to the event database. Furthermore, 
the web-based database has provisions for uploading (or attaching) any available supporting information; 
e.g. laboratory reports, root cause analysis reports. 

Section 2 of this report includes high-level summaries of selected national RIM practices. The 
CODAP-PRG recognises that significant efforts are continuously being directed towards NDE 
performance demonstration. It is one of several evolving aspects of RIM. Based on publicly available 
information, the puipose of Section 2 is to highlight certain aspects of past and current national 
performance demonstration activities. 

1.5 Report structure and reading guide 

This topical report consists of seven sections and four appendices. Section 2 describes selected codes and 
standards for RIM. The section addresses the requirements for ISI and NDE qualification as defined in 
ASME XI, Canadian Standards Association (CSA) rules, German KTA rules, French RCC-M Code, and 
Korean rules. Section 3 documents how structural integrity management influences are recorded in the 


3. This includes RIM program definition, implementation and monitoring, application of qualified NDE techniques, 
documentation, and evaluation of NDE results. 
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CODAP event database. Section 4 documents CODAP database insights regarding the effectiveness of 
RIM. Key lessons learnt regarding leak detection and RIM performance deficiencies are highlighted. High- 
level database insights are summarised in a suite of charts and tables. Section 5 describes methodologies 
for addressing the integrity management factor in Equation 1.1 above and how it relates to field experience 
data. A summary and conclusions are documented in Section 6. Finally, a list of references is provided in 
Section 7. Appendix A is an OPDE/CODAP bibliography including references to database applications 
performed or sponsored by OPDE/CODAP member organisations. Appendix B is a high-level CODAP 
event database status report; Appendix C is a glossary of terms; and Appendix D includes a piping safety 
class cross reference table. 
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2. RELIABILITY AND INTEGRITY MANAGEMENT PRACTICES 


The CODAP event database design is based on a detailed consideration of passive component reliability 
attributes and influence factors. For those RIM Programme that rely on non-destructive examination 
(NDE), NDE qualification techniques continue to play an important role in ensuring a high degree of 
structural integrity of reactor components. The event histories that are included in the database are 
manifestations of effective implementation of RIM as well as failures of RIM to identify structural flaws 
(e.g. non-through-wall cracks) before exceeding code requirements or design limits. The objective of this 
section is to summarise current ISI requirements and the associated NDE qualification requirements as 
formulated in national codes and standards for reactor components. Also included is an overview of owner- 
defined (or augmented) in-service inspection programme that go beyond inspection requirements as 
formulated in existing codes and standards. In some cases, these owner-defined inspection programme 
have been formulated on the basis of risk insights from plant-specific probabilistic safety assessment 
(PSA) studies. 

2.1 ASME Section XI, Appendix VIII 

The US Nuclear Regulatory Commission (NRC) establishes rules and regulations for the operation of 
domestic nuclear facilities. Section XI of the ASME Code contains the rules for ISI of nuclear plant 
components [9]. Through Title 10 of the Code of Federal Regulation, Part 50.55a, Codes and Standards 
(10 CFR 50.55a) 1 , the NRC incorporates by reference (thus, mandates the implementation of) the ASME 
Code, Section XI, Division 1, Appendix VIII, “Performance Demonstration for Ultrasonic Examination 
Systems”. Appendix VIII of ASME XI requires qualification of the procedures, personnel, and equipment 
used to detect and size flaws in piping, bolting, and the reactor pressure vessel. Each organisation 
(e.g. owner or vendor) will be required to have a written programme to insure compliance with the 
requirements. The general requirements for qualification of non-destructive examination (NDE) personnel 
contained in Section XI, IWA-2300, are amended by Section XI, Appendix VIII. Appendix VIII describes 
the additional requirements for performance demonstration of ultrasonic examination systems that integrate 
personnel, equipment, and procedures into a single entity. ASME Code Section XI, Appendix VIII, also 
includes supplements that contain specific instructions for the conduct of performance demonstrations 
including test specimen requirements, conduct of performance demonstration and acceptance criteria. 

The Performance Demonstration Initiative (PDI) was formed by US utilities in 1991. Its primary 
focus was to provide an efficient, cost-effective, and technically sound implementation of Appendix VIII 
performance demonstration requirements. The EPRI NDE Centre is the Performance Demonstration 
Administrator (PDA) for the programme and provides technical and implementation support to develop 
detailed implementation processes and facilities to ensure that all requirements of Appendix VIII of ASME 
Section XI and relevant modifications required by 10CFR50.55a are met [14], Using common protocols 
and sample sets, the need for site-specific performance demonstrations is minimised. Piping, bolting, and 
reactor pressure vessel (RPV) shell weld performance demonstration testing began in 1994 [15]. The 
demonstration phase for piping and RPV shell welds has provided significant information relative to the 


1. For additional information got www.nrc.gov/reading-rm/doc-collections/cfr/part050/part050-0055a.html . 
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reliability of ultrasonic examinations. The numbers of measurements are in excess of 16 000 for piping 
detection and length sizing [16]. 

With the publication of the revised 10 CFR 50.55a rule on 22 Septemberl999, the NRC required 
expedited implementation of all Appendix VIII requirements 2 . As a result, PDI initiated activities for a 
Phase II of the Programme. Phase I of the PDI Programme addressed important problems that could have 
significant impacts on the cost and effectiveness of the US performance demonstration approach. These 
included the nozzle inner-radius examination from the outside surface, nozzle-to-shell weld examinations, 
and dissimilar metal welds (DMW). 

The PDI Programme addresses the sample fabrication and operational requirements for a unified 
performance demonstration programme operated by EPRI. The EPRI Programme contains established 
requirements for the demonstration test blocks as well as the rules and protocol for the programme 
operation. 

The samples are a critical ingredient of the programme and represent a substantial portion of the total 
cost. The samples are designed to cover the widest practicable range of components in typical boiling 
water and pressurised water reactors. Detailed dimensional information was obtained and reviewed to 
design samples that span the maximum range according to the rules in Appendix VIII that govern the range 
of qualifications. 

2.1.1 Code comparison 

The Multinational Design Evaluation Programme (MDEP) Code Comparison Project was initiated in late 
2006 in response to a request by the MDEP Codes and Standards Working Group (CSWG). The CSWG 
facilitated a project to develop comparisons of the examination requirements for Code Class 1 vessels, 
piping, pumps and valves. These comparisons addressed multiple code sections and subsections, including 
rules for ISI. Published in 2012, Report STP-NU-051-1 [17] documents the differences in ISI examination 
requirements between major international nuclear codes and standards for Class 1 equipment; namely those 
of AFCEN (RCC-M), ASME (Section III), CSA (N-285), JSME (S NCI), KEA, Korea Electric Power 
Industry Code (KEPIC-MN) and NIKIET (PNAE-G7). Further elaborations are documented below. 

2.2 Canadian Standards Association Periodic Inspection Programme 

CSA-N285.4 1.1 [18] defines requirements for the periodic inspection of primary heat transport and 
auxiliary pressure-retaining systems, components, and supports that form part of a CANDU nuclear power 
plant. Compliance with CSA N285.4 is a licensing requirement for Canadian CANDU plants and has been 
adopted for CANDU plants outside of Canada. CSA N285.4 provides criteria to establish the inspection 
requirements for system or portions of systems subject to inspection, including: 

(a) Systems, and systems connected thereto, containing the fluid that, under normal conditions, 
directly transports heat from nuclear fuel, and other systems whose failure can result in a 
significant release of radioactive substances. 

(b) Systems essential for the safe shutdown of the reactor and/or the safe cooling of the nuclear fuel 
in the event of a process system failure. 

(c) Systems and equipment whose failure or dislodgement could jeopardise the integrity of systems 
in Item (a) or (b), or both. 

In addition the CSA establishes specific inspection requirements for fuel channel pressure tubes, 
feeder piping and steam generator tubes. Inspection categories in CSA N285.4 are determined based on 
failure size, fatigue usage and stress intensity. Inspection categories are A, B, Cl and C2, with category A 


2. For additional details, go to www.nrc.gov/reading-rm/doc-collections/cfr/part050/part050-0Q55a.html 
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being the highest and category C2 the lowest (no inspection required). CSA N285.4 provides an implicit 
risk-related rationale for selection of inspection locations by: 

• Selecting high risk areas (high inspection categories) with high failure consequence (failure size) 
and high failure potential (fatigue usage and stress intensity) for inspection; 

• Minimising inspection scope, effort and dose by reducing inspections in areas with low failure 
potential and low consequence; and 

• Including provisions such as exempting systems or portions of systems from inspection if they 
are periodically tested or system pressure is continuously monitored. 

N285.4 provides guidelines for the classification of components into families based upon design and 
service conditions and provides sampling requirements for the number of components within each family 
requiring inspection. For multi-unit stations, the sampling criteria also considers the number of components 
within a family across all units. The lead unit (typically the unit with the highest number of effective full 
power operating hours) will require the largest sample of components inspected within a family and the 
number of components is reduced for the following units. If service-induced degradation is identified 
within a family of components, the sample size must be re-evaluated to ensure that the degradation 
mechanism is effectively managed. CSA N285.4 sampling criteria differs from RI-IS1 methodologies, 
where a percentage of welds from each risk category are selected. 

CSA N285.4 allows for the exclusion of systems (or portions of systems) from inspection when the 
subject component: 

• has adequate barriers between fluid boundary and nuclear fuel; 

• has adequate barriers between fluid boundary and the outside atmosphere; 

• has acceptable level of dose release in the case of system failure and without operation of the 
containment system; or 

• is dormant and is subject to periodic testing or continuous pressure monitoring all the time. 

Because of the unique design of the CANDU Primary Heat Transport System (PHTS), design-specific 
NDE qualification programme and NDE technologies have been developed. Special manual and automated 
NDE tools have been developed to inspect for pipe wall thinning and cracking at tight radius PHTS feeder 
pipe bends 3 [19]. In addition, NDE tools have been developed for the inspection of pressure tubes for 
service-induced degradation, irradiation induced wall thickness changes, spacer location and the 
measurement of the gap between a pressure tube and a Calandria tube [20]. 

CSA N285.4 contains a general requirement for licensees to demonstrate the performance of the 
adequacy of all inspection procedures used to detect and size flaws and demonstrate the proficiency of 
inspection personnel. The 2009 edition of the standard introduced specific requirements for inspection 
qualification for volumetric inspection methods (typically ultrasonic or eddy-current methods), which 
includes: 

• a specification of the specific inspection requirements for each application of the inspection 
method; 

• an inspection procedure that defines the application of the inspection method; 

• a report that documents how the procedure satisfies the specified inspection requirements; and 

• a personnel training and qualification programme. 


3. The PHTS consists of a large volume of small-diameter piping (DN50 to DN65 inlet/outlet feeders). Due to the complex 
configuration of the PHTS piping, extensive NDE qualification programs have been implemented in conjunction with 
automated NDE data collection systems. 
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To satisfy this inspection qualification requirement of the CSA standard, the Canadian CANDU 
industry has chosen to adopt a process based upon the ENIQ approach to inspection qualification and set 
up the CANDU Inspection Qualification Bureau (CIQB) to establish industry guidelines for the 
qualification of inspection procedures and qualification of personnel [21]. The CIQB was established 
through the CANDU Owners Group (COG) but operates independently from the Canadian utilities. COG 
is also a member of the ENIQ steering committee. 

A previously mentioned, the definition of an N285.4 inspection programme contains risk elements 
when considering the likelihood and consequences of failure when selecting inspection locations. 
However, the Canadian regulator, the Canadian Nuclear Safety Commission (CNSC), and the Canadian 
industry have undertaken projects to assess the possibility of adopting risk-informed in-service inspection 
(RI-ISI) [22] in lieu of the current N285.4 requirements. Information obtained through preliminary work 
and pilot studies developed by the regulator and industry has been evaluated and it has been mutually 
agreed that the adoption of an RI-ISI methodology would best be implemented through the CSA standards 
development process. Work to date has suggested that the EPRI methodology for an RI-ISI Programme 
[22] would be the most appropriate for Canadian CANDU applications. Update No. 1 for the 2014 edition 
of the N285.4 standard, which underwent public review in 2015, will incorporate a non-mandatory annex 
providing an alternate methodology for identifying components susceptible to fatigue related degradation 
mechanisms based upon the EPRI RI-ISI degradation assessment. This will be a first step at the 
implementation of RI-ISI based information into that standard. 

In addition to conducting inspections on the PHTS and auxiliary systems, Canadian NPP licences 
require utilities to implement inspection programme for safety significant balance of plant pressure- 
retaining systems and components. In order to establish a consistent approach to satisfying this licence 
requirement, a new standard, CSA N285.7, Periodic inspection of CANDU nuclear power plant balance of 
plant systems and components, has been drafted and publication is expected in 2016. This standard will 
apply the EPRI RI-ISI methodology to balance of plant pressure boundary systems and components to 
identify those having the most significant impact of core damage frequency (CDF) should they fail during 
operation due to service-induced degradation. The standard incorporates inspection qualification 
requirements for procedures and personnel that are consistent with CSA N285.4. 

2.3 French RSE-M code 

The RSE-M, “Regies de Surveillance en exploitation des Materiels Mecaniques des Hots Nucleates REP” (“In- 
Service Inspection Rules for Mechanical Components of PWR Nuclear Islands”) [24] is the French equivalent 
to ASME Boiler and Pressure Vessel Code, Section XI. Section A of RSE-M deals with the application of 
destructive and non-destructive testing methods for examining materials or components after their manufacture 
and during their operation. RSE-M A 4000 defines the requirements for the certification of NDE personnel for 
in-service components. This section of RSE-M requires personnel to be certified by a third party according to 
NF EN ISO 9712 [25] or its other European counterparts. The first edition of the RSE-M code was issued in 
1989. Relative to ASME XI, for Code Class 1 components RSE-M differs in several areas with respect to 
inspection intervals, prescribed NDE technologies, and flaw evaluation processes. 

2.4 Nuclear Safety Standards Commission (KTA) 

The German safety standard KTA 3201.4 “In-Service Inspections and Operational Monitoring” [26] 
documents the detailed measures which shall be taken to meet these requirements within the scope of its 
application. For this purpose, a large number of standards from conventional engineering, in particular DIN 
standards, are also referenced; these are specified in each particular case. The requirements specified under 
KTA 3201.4 address the following activities: 

• reliable monitoring of operating conditions; 

• adequate extent of NDEs; 
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• documentation, evaluation, safety-oriented application and up-dating of operating experience; 

• foreseen identifiability of changes of the as-fabricated condition of the reactor coolant pressure 
boundary by means of ISI and operational monitoring; 

• evaluation of the results of in-service expections and operational monitoring. 

Section 7.4 of KTA 3201.4 documents requirements regarding NDE personnel. The test personnel 
shall have been qualified and certified to satisfy the requirements of DIN 25435-1, DIN 25435-2, DIN 
25435-3, DIN 25435-4, DIN 25435-6 and DIN 25435-7 for the test methods to be used. With respect to 
manual UT, the test personnel shall fulfil all requirements of DIN 25435-1 Table 2. For eddy-current 
testing performed on steam generator tubes the test personnel shall satisfy the conditions of DIN 25435-6 
Table 1. The test personnel for evaluation of the general condition shall have the knowledge required to 
perform their tasks and shall have demonstrated sufficient visual capacity. Finally, the test personnel for 
functional tests shall have the knowledge required to perform their tasks. 

Section 8 of KTA 3201.4 documents requirements concerning the evaluation of NDE results. As 
general principles, “conspicuous findings and peculiarities that influence the result shall be recorded and 
evaluated.” The test supervisory personnel of the testing agency, the plant owner and the authorised 
inspector shall convince themselves and confirm within the recording activities that the tests have been 
performed completely to satisfy the requirements and have been evaluated correctly to ensure 
reconstruction. 

The German approach to RIM is the subject of the draft KTA 3206 [27] [28] [29]. In Germany, the 
leak-before-break (LBB) concept was implemented for all commercial nuclear power plants in the 1980s. 
The technical approach to LBB is based on application of advanced condition monitoring systems 
specifically developed to address the major structural integrity influence factors including local loading 
conditions. Through the use of these advanced monitoring systems it was possible at the outset to establish 
modes of operation that minimise the load on components, to implement out appropriate technical back-fit 
measures, and to identify degradation mechanisms and the appropriate degradation mitigation processes. 

2.5 Korean Nuclear Safety and Security Commission (NSSC) and KEPIC MI 

The Korean NSSC establishes rules and regulations for the operation of domestic nuclear facilities. The 
NSSC has established the KEPIC as the approved technical standard used to confirm the safety of nuclear 
facilities 4 . The Notice of the NSSC “Regulation on In-Service Inspection of the Nuclear Reactor Facilities” 
requires that MI (ISI) of KEPIC shall apply to the ISI of domestic PWRs. KEPIC MI is the Korean 
equivalent to the ASME code Section XI which contains the rules for ISI of nuclear plant components. For 
the ISI of the pressurised heavy water reactor (PHWR), CSA N285.4 shall apply. 

The NSSC Notice for ISI also requires augmented inspection for the butt welds of class 1 piping (not 
less than 2-inch nominal pipe size) that is attached to the reactor coolant pressure boundary (RCPB) and is 
non-isolable during normal operation. For these piping butt welds in PWRs, volumetric examination in 
addition to surface examination required by KEPIC MI shall be performed. In the case of the PHWR, both 
volumetric and surface examination shall be performed for these butt welds which had been excluded from 
the scope of ISI. This augmented requirement was included as a result of two RCPB leak events in primary 
heat transport purification system piping welds in a Korea PHWR unit in 2001 and 2002. After the events, 
a task force team was formed to develop a comprehensive safety enhancement programme for welds which 
became the basis of the augmented inspection. 

The requirements of performance demonstration of NDE were included in the NSSC Notice in 2004. 
The installer or operator shall conduct the performance demonstration of ultrasonic testing (UT) for the 
safety-related nuclear components and of eddy-current testing (ECT) for steam generator tubes. The 


4. For more information go to www.electricity.or.kr/english/kea/industry%20code.php 
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technical standards of the UT performance demonstration shall be KEPIC MI and its mandatory 
Appendix VIII (Equivalent to ASME Code Section XI, Appendix VIII). The operator shall submit the 
report to the NSSC three months prior to application of performance demonstration. The report shall 
address: 


• name and address of the organisation carrying out performance demonstration; 

• applicable technical standards for performance demonstration and their edition; 

• test specimen or test data of performance demonstration; 

• evaluation of performance demonstration; 

• quality assurance of performance demonstration; 

• security related to performance demonstration; 

• operation of performance demonstration system; and 

• other related items. 

The organisation carrying out performance demonstration shall report every year the status of the 
demonstration to the NSSC. For the application of KEPIC, limitations defined in the Notice of the NSSC 
“Guidelines for Application of Korea Electric Power Industry Code (KEPIC) as Technical Standards of 
Nuclear Reactor Facilities” shall be followed. 

2.6 European Network for Inspection and Qualification 

The European Network for Inspection and Qualification (ENIQ) was formed in 1992 and reflects the 
importance of the issue of qualification of NDE inspection procedures used in ISI programme for nuclear 
power plants. Driven by European Nuclear Utilities and managed by the European Commission Joint 
Research Centre (JRC) in Petten, the Netherlands, ENIQ was intended to be a network in which the 
available resources and expertise could be consistently managed throughout Europe. It was also recognised 
that harmonisation with respect to codes and standards for inspection qualification would represent 
important advantages for all parties involved, with the ultimate goal of increasing the safety of European 
nuclear power plants. 

ENIQ work is carried out by two sub-groups: the Task Group on Qualification (TGQ) focuses on the 
qualification of ISI systems, while the Task Group on Risk (TGR) focuses on risk-informed in-service 
inspection (RI-ISI) issues. The TGR has published the European Framework Document for RI-ISI [30], 
and is producing more detailed recommended practices and discussion documents on several technical 
issues specific to RI-ISI. 

Since 2005 ENIQ has published a set of ten recommended practices for the development and 
implementation of RIM strategies. These recommended practices address the following topics 5 : 

1. NDE qualification; 

2. strategy and recommended contents for technical justifications; 

3. recommended contents for the qualifications dossier; 

4. guidelines for the design of test pieces and conduct of test piece trials; 

5. the use of modelling in inspection qualification; 

6. recommended general requirements for a body operating qualification of non-destructive tests; 


5. The ENIQ Recommended Practice publications are available on the Internet at http ://capturc. ire. cc.curopa.cu/capturc//enin- 
recommended-practice 
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7. qualification levels and approaches; 

8. verification and validation of structural reliability models and associated software to be used 
in RI-ISI; 

9. personnel qualifications; 

10. guidance on expert panels in RI-ISI. 

2.7 NDE qualification methodologies 

An overview of the evolution of NDE qualification is found in Reference [31]. The field experience with 
NDE including failures of NDE to detect flaws prompted the development of procedures and processes to 
enhance NDE reliability. NDE qualification is concerned with the ability, capability of NDE technology 
(hardware and software) and the competency of NDE personnel. Where applicable, information about 
component-specific NDE qualifications is included in the CODAP event database under “ISI history.” The 
NDE technology includes manual and automated flaw detection techniques. In order to determine the 
ability of NDE to reliably detect subsurface or surface flaws, systems have been devised to ensure that 
NDE personnel have the proper training, have passed written and practical examinations, and have enough 
experience to properly perform NDE tasks using the applicable test method or technique. Personnel that 
have met all three of these requirements may then be certified, which is defined in several different ways 
under the various NDE systems. ASME XI Article IWA-2300 defines the NDE personnel qualifications 
requirements. In the US, the American Society for Non-destructive Testing (ASNT) has developed 
standards and recommended practices for qualification and certification of NDE personnel: 

• Certification Standard: National or international documents describing the requirements for the 
qualification and certification of NDE personnel. 

• Recommended Practice: A formal document that provides nationally or internationally 
recognised guidelines, and describes the qualification and certification process for NDE 
personnel. If mandated by governing codes, standards, specifications or contract documents, 
these guidelines become requirements for the specified project. 

• Certification System: The combination of the standard or recommended practice governing the 
certification requirements, the third-party certification programme (if applicable) or the 
employer's written practice, and additional employer documents used in the administration of 
their certification programme. 

• Certification programme: The documented employer’s or certification body’s procedures and 
processes based on a standard or recommended practice, which defines the requirements of that 
specific programme. 

There are multiple NDE certification systems worldwide, but they can generally be divided into two 
main types: “utility-based” and “central” certification systems. 

• Utility-based certification system in which the nuclear power plant owner/operator is responsible 
for the administration of the training and the examinations of their own NDE personnel, as well 
as the documentation of the required Paining, examinations and experience in accordance with an 
in-house standard or recommended practice. Most utility-based systems do allow the 
owner/operator to accept training and examination services provided by outside agencies 
provided it is properly documented and the employer has determined that the content of those 
services meet their own company requirements as described in the owner’s/operator’s NDE 
procedures. Reference [32] is an example of a utility-based NDE qualification and certification 
system. 

• Upon proof of certification, the owner/operator may issue a certificate, which can be a formal 
certificate or in letter format, and can authorise their personnel to perform NDE tasks. In all 
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utility-based systems, the employer is responsible for authorising their personnel to perform such 
work. Because utility-based certification is usually tailored to plant-specific needs, the resulting 
certifications expire when an employee leaves the company that issued the certification. 

Central certification systems are systems in which the examinations are administered by an 
independent third-party certification body based on a central certification standard. To be eligible to sit for 
these examinations, prospective candidates must provide acceptable documentation of their training and 
experience to the certification body. Upon successful completion of the third-party examinations, the 
certification body will issue a certificate attesting to the fact that the named certificate holder has met the 
requirements and passed the examinations described in the third-party certification system. The employer 
can then choose to accept the third-party certificate(s) as proof of certification. As with employer-based 
systems, the employer has the ultimate responsibility to certify (authorise) the certificate holder to perform 
NDE tasks. Most certification programme have three levels of NDE qualification: Level I, Level II and 
Level 111. The descriptions provided here are from the 2006 edition of the ASNT Recommended Practice 
No. SNT-TC-1A [33], 

• NDE Level I personnel should be qualified to properly perform specific calibrations, specific 
NDE and specific evaluations for acceptance or rejection determinations according to written 
instructions and to record results. The NDE Level 1 should receive the necessary instruction and 
supervision from a certified NDE Level 11 or 111 individual. 

• NDE Level II personnel should be qualified to set up and calibrate equipment and to interpret and 
evaluate results with respect to applicable codes, standards and specifications. The NDE Level II 
should be thoroughly familiar with the scope and limitations of the methods for which he is 
qualified and should exercise assigned responsibility for on-the-job training and guidance of 
trainees and NDE Level I personnel. The NDE Level II should be able to organise and report the 
results of NDE tests. 

• NDE Level III personnel should be capable of developing, qualifying and approving procedures, 
establishing and approving techniques, interpreting codes, standards, specifications and 
procedures, as well as designating the particular NDE methods, techniques and procedures to be 
used. The NDE Level III should be responsible for the NDE operations for which he is qualified 
and assigned and should be capable of interpreting and evaluating results in terms of existing 
codes, standards and specifications. The NDE Level III should have sufficient practical 
background in applicable materials, fabrication and product technology to establish techniques 
and to assist in establishing acceptance criteria when none are otherwise available. The NDE 
Level III should have general familiarity with other appropriate NDE methods, as demonstrated 
by an ASNT Level III Basic examination or other means. The NDE Level III, in the methods in 
which he is certified, should be capable of training and examining NDE Level I and II personnel 
for certification in those methods. 

• NDE Instructor: The term “NDE Instructor” is used in the ANSEASNT Standard CP-189 
(Qualification and Certification of Non-destructive Testing Personnel) [34], to describe an 
individual with the skills and knowledge to plan, organise and present classroom, laboratory, 
demonstration, and/or on-the-job NDE instruction, training and/or education programme. 

ASME XI, Mandatory Appendices VI, VII and VIII document qualification requirements for NDE 
personnel performing visual examination, for personnel performing UT examination, and for performance 
demonstration of ultrasonic examination systems, respectively. The US nuclear industry and several 
international utilities relies on the EPRI/PDI Appendix VIII Programme to satisfy the ASME XI 
requirements as well as the 10 CFR 50.55a rule (refer to Section 2.1 of this report). Similarly, the European 
Qualification Methodology Document (EQMD) contains guidelines for the qualification of NDE and it 
addresses technical justification, which involves assembling all the supporting evidence for inspection 
capability (results of capability evaluation exercises, feedback from site experience, applicable and 
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validated theoretical models, physical reasoning), and may include practical trials using deliberately 
defective test pieces. 

In 2007 the World Nuclear Association (WNA) established the Co-operation in Reactor Design 
Evaluation and Licensing Working Group (CORDEL WG) with the aim of stimulating a dialogue between 
the nuclear industry (including reactor vendors, operators and utilities) and nuclear regulators on the 
benefits and means of achieving a worldwide convergence of reactor safety standards for reactor designs. 

The Codes and Standards Task Force (CSTF) of the CORDEL WG was set up in 2010 to collaborate 
with the Standards Developing Organisations (SDOs) and the MDEP Codes and Standards Working Group 
(CSWG) on the international convergence of mechanical codes and standards, related to the design and 
quality of nuclear power plant components that are important to safety. 

The CORDEL WG also encouraged the CSTF to work with the SDOs with the objective of 
identifying areas where a) convergence seemed most feasible; or b) a demonstration of equivalent level of 
safety could be made. On the basis of an internal survey the CSTF established two pilot projects. The first 
focused on regulatory requirements: Qualifications for NDE personnel. The other project relates to 
technical requirements: Non-Linear Analysis Methodologies Code Requirements. This first report on 
Qualification of NDE Personnel looks at and compares requirements in the major nuclear design codes, 
presents current international industrial certification practices and presents a recommendation for 
convergence in certification requirements of the different codes. A proposal for a harmonised international 
alternative for the certification of NDE personnel has been proposed by the CORDEL WG [35]. 

According to CORDEL, there are three stages that NDE personnel have to undergo before they are 
qualified to perform a test on Class 1 components (not required for class 2 and 3 components) in most 
countries. These are Certification, Training and Qualification. The first stage, Certification, is required by 
nuclear design codes and national regulators. For example, in the United States this includes an ASNT 
SNT-TC-1A type certification under ASME Section 111 while in France it includes EN ISO 9712 [36] in 
the RCC-M. The certification required by each of the design codes investigated is summarised in the 
MDEP-CSWG code comparison report. Due to the different requirements, the inability to easily transfer 
certification between countries establishes a major obstacle to vendors and operators of existing plants and 
new builds. The effect of this on the international markets makes it an issue CORDEL CSTF aims to 
resolve. 

The second stage, Training, is defined as additional in-house, job or site-specific training (procedure 
training, definition of degradation mechanisms, specificities of inspected components). This is often 
required by employers, before the employee is authorised to conduct an examination. This is not a code 
requirement and is applied at the discretion of the employer based on its needs and its culture. These can be 
particularly important when a third-party certification is used to ensure that personnel are fit to follow a 
written procedure and perform an NDE test. 

The third stage. Qualification, is the highest level. An independent third party is required to validate 
the qualification to the certificate holder. This qualification is normally specific to the control of Class 1 
components. The ENIQ framework and Section XI requirements are the two major sets of requirements for 
certification of NDE personnel for ISI of nuclear-grade components internationally. It is important to 
understand the differences between the personnel certification schemes described by EN ISO 9712:2012 or 
ASNT SNT-TC-1A. and qualification of an NDE personnel inspection system in accordance with the 
ENIQ Methodology for Qualification (EMQ). ASME Appendix VIII describes the requirements for 
qualification of procedures, equipment and personnel. 

• The certification processes (ISO 9712 and SNT-TC-1A) explain how to qualify the workforce for 
a basic assessment of the basic knowledge of a method or technique. These certification 
processes provide confidence that an operator who is successfully certified in accordance with 
the process has broad knowledge of the principles, application and capability of a particular NDE 
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method for a range of situations. In other words, it is a ‘method’-based certification process for 
personnel. 

• The qualification of the personnel or a procedure according to the ENIQ EMQ or EPRI Appendix 
VIII Programme define performance-based requirements. A qualification of an NDE system in 
accordance with the ENIQ or Appendix VIII methodologies is a more stringent process that 
demonstrates that the combination of inspection system and personnel with an acceptable of 
knowledge, obtained via a training dossier, is capable of achieving very specific defect detection 
and sizing criteria in a particular situation. 

Convergence of certification requirements would provide vendors with the confidence that the 
certified personnel have a broad knowledge of NDE methods. This will allow for transferability of 
personnel but will not change the responsibility of the vendor to ensure that the procedure, and the capacity 
of the personnel to apply the procedure, is adequate. 

2.8 Owner-Defined Integrity Management Programme 

An owner-defined (or augmented) ISI Programme goes beyond inspection requirements as formulated in 
existing codes and standards. There are two types of owner-defined programme: 1) Programme developed 
to address specific types of degradation mechanisms, and 2) Programme developed to address plant- 
specific risk insights on the basis of PSA, especially internal flooding vulnerabilities. Examples of the 
former include flow-accelerated corrosion (FAC) inspection programme, inspection programme 
responding to the Boiling Water Reactor Vessel and Internals Project (BWRVIP), and inspection 
programme that address PWSCC in DMW (see Section 2.9). In the US many utilities have committed to 
implement the BWRVIP guidelines. Examples of the second type inspection programme include 
volumetric inspection programme for selected Code Class 3 and non-Code piping systems. 

The CODAP first topical report [4] documents examples of different national FAC inspection 
programme and implementation practices. As one example, in the US, Generic Letter 89-08 [37] requested 
that all licensees implement a long-term FAC detection programme to prevent pipe failures in high-energy 
(single- and two-phase) carbon steel piping systems. The programmes are developed by each utility using 
plant-specific conditions, industry-wide operating experience, engineering judgement, NDE techniques, 
and computer analysis of high-energy carbon steel piping systems. As stated in the NRC Inspection 
Manual, Procedure 49001, “the long-term programme must be well defined, with clearly documented 
results, and must include a complete analysis of the susceptible systems, inspection of the most susceptible 
piping components, repair or replacement of damaged piping components, trending of inspection data in 
order to determine FAC rates, and continued analysis based on inspection findings.” 

An example of a service water piping augmented inspection programme is documented in 
Reference [38]. According to this example, the programme activities are subject to inspection during the 
formal NRC triennial heat sink performance inspection. In addition to inspecting the Indian Point Energy 
Centre (IPEC) Programme during the triennial heat sink performance inspections, the NRC Staff reviewed 
the programme during the licence renewal ageing management programme audits in 2008. Changes to the 
programme since its inception in response to GL 89-13 [39] were reflected in the programme 
documentation reviewed in 2008. There have been improvements and enhancements to the programme 
since 2008. Typically, changes to the programme entail the addition of activities that were not required by 
commitments to GL 89-13. For example, following a leak in 1995 6 , the programme was modified to add 
valve inspections in addition to the piping inspections that were established to meet GL 89-13 
commitments. Furthermore, the IPEC Programme was changed to increase the number and frequency of 
inspections of non-safety-related piping [38]. 


6. CODAP Event Database record #4401. 
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The established Service Water Integrity Programme targets susceptible locations for wall thickness 
inspections and conducts follow-up inspections for trending purposes of piping locations where corrosion 
has been previously identified. The programme provides a means to proactively detect and repair areas of 
concern, while also providing a means to schedule and perform future inspections/repairs. The Service 
Water Integrity Programme inspects about 20-30 welds per unit prior to each outage (i.e. pre-outage) 
which includes both new inspection points as well as follow-up exams of known areas of concern. 
Generally, new locations form the majority of the inspection points, and the follow-up inspection points are 
a lesser portion. This is mainly because if areas of concern are found, wall thickness calculations are 
performed and repairs are planned based on the projected remaining life. Since 1997, there have been over 
600 weld examinations performed at both Indian Point nuclear reactor units, with greater than 90% of the 
examined welds meeting the applicable acceptance criteria [38]. Those welds not meeting the established 
acceptance criteria are repaired during subsequent refuelling outages. 

Another example of an augmented inspection programme is concerned with BWR core shroud welds. 
In 1990, crack indications were reported at core shroud welds located in the beltline region of 
Kernkraftwerk Miihleberg (KKM). This reactor had completed approximately 190 months of power 
operation before the cracks were discovered. As a result of this discovery, General Electric (GE) issued 
Rapid Information Communication Services Information Letter (RICSIL) 054, “Core Support Shroud 
Crack Indications”, on 3 October 1990, to all owners of GE BWRs. The RICSIL summarised the cracking 
found in the overseas reactor and recommended that at the next refuelling outage plants with high-carbon- 
type 304 stainless steel shrouds perform a visual examination of the accessible areas of the seam welds and 
associated HAZ on the inside and outside surfaces of the shroud. In 1994 the US NRC issued Generic 
Letter 94-03 [40] to request that each BWR licensee: (1) inspect the core shrouds in their BWR plants no 
later than the next scheduled refuelling outage, and perform an appropriate evaluation and/or repair based 
on the results of the inspection; and (2) perform a safety analysis supporting continued operation of the 
facility until inspections are conducted. Furthermore, this Generic Letter requested that each BWR licensee 
develop an inspection plan which addresses: (a) all shroud welds (from support attachments to the vessel to 
the top of the shroud) and/or provides a justification for elimination of particular welds from consideration; 
and (b) examination methods with appropriate consideration given to use of the best available technology 
and industry inspection experience (e.g. enhanced VT-1 visual inspections, optimised UT techniques). 
Standard methods for inspection of core support structures as specified by the ASME Code, Section XI, 
have been shown to be inadequate for consistent detection of Intergranular Stress Corrosion Cracking 
(IGSCC) in-core shrouds. In 1994, US BWR-owning utilities formed the BWRVIP [41], which is chartered 
to support a programme addressing the problems of reactor internals, internal attachments, vessel welds, 
and vessel nozzles. Most international BWR owners have become members of the BWRVIP. 

Based on PSA results, for example internal flooding PSA results, many plants have implemented 
NDE Programme for plant systems such as the Circulating Water System, Fire Protection Water System 
and service water system. Under these plant-specific RIM Programme, certain sections of these piping 
sections undergo periodic 100% volumetric examinations using UT technique or other types of NDE 
techniques. As defined by ASME Code Case N-460, “essentially 100%” means greater than 90% of the 
examination volume of each weld where reduction in coverage is due to interference by another component 
or part geometry [42], 

2.9 Code Case N-729-1 

ASME Code Case N-729-1 (2006), “Alternate Examination Requirements for PWR Reactor Vessel Upper 
Heads With Nozzles Having Pressure-Retaining Partial-Penetration Welds” [43] was approved for addition 
into the code on March 28, 2006. A majority of this code case deals with the type of inspections to be 
performed, i.e. volumetric or surface inspections. The basis for these examination requirements was 
developed as part of an industry programme conducted by the Materials Reliability Programme (MRP) 
through EPRI. The results of this programme were published in MRP-95 Rev. 1 [44] and document a set of 
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finite element weld residual stress analyses conducted on a variety of upper head penetration nozzles. The 
inspection zone selected by the industry was based on the stress where it was assumed that primary water 
stress corrosion cracking (PWSCC) would not initiate. As explained in MRP-95 Rev. 1, it has been 
illustrated that PWSCC does not occur in the Alloy-600 tube when the stresses are below the yield strength 
of that tube. 

The Code Case N-729-1 inspection plan for RPV upper heads with Alloy 600/182/82 penetration 
nozzles and welds requires periodic bare metal visual (BMV) examinations and periodic nonvisual 
examinations using UT, ECT, or dye penetrant testing of the penetration nozzle base metal. BMV 
examinations are performed in order to provide indication of any primary coolant leakage based on the 
presence of boric acid deposit accumulations. Nonvisual examinations are performed in order to identify 
flaws which could lead to leakage or failure of the penetration nozzle. 

Such inspections are also required to be performed for RPV upper heads with Alloy 690/152/52 
penetration nozzles and welds, but the frequency of inspection is reduced. This reduction is due to the 
enhanced resistance of these materials against PWSCC. 

• According to the NRC, Code Case N-729-1 provides an acceptable level of quality and safety as 
a long-term inspection plan in lieu of the requirements of the Order 7 , subject to the following 
limitations and conditions: 

• Item B4.40 of Code Case N-729-1, Table 1, shall be inspected at least every fourth refuelling 
outage or at least every seven calendar years, whichever occurs first, after the first ten-year 
inspection interval. 

• If flaws attributed to PWSCC have been detected, whether acceptable or not for continued 
service under Paragraphs - 3130 or - 3140, the re-inspection interval shall be each outage instead 
of the re-inspection intervals required by Table 1 of the Code Case. 

• Instead of the specified ‘examination method’ requirements for volumetric and surface 
examinations of Note 6 in Table 1 of the Code Case, the licensee shall perform volumetric and/or 
surface examination of essentially 100% of the required volume or equivalent surfaces of the 
nozzle tube, as identified by Fig. 2 of ASME Code Case N-729-1 [43]. A surface examination 
shall be performed on all J-groove welds. If a surface examination is being substituted for a 
volumetric examination on a portion of a penetration nozzle that is below the toe of the J -groove 
weld (Point E on Fig. 2 of ASME Code Case N-729-1 [43]), the surface examination shall be of 
the inside and outside wetted surface of the penetration nozzle not examined volumetrically. 


7. For details, refer to www.nrc.gov/docs/ML0622/ML062220594.pdf 
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• Appendix 1 of ASME Code Case N-729-1 shall not be implemented without prior NRC approval. 

• After September 2009, UT-examinations shall be performed using personnel, procedures and 
equipment that have been qualified by blind demonstration on representative mockups using a 
methodology that meets the conditions specified below instead of the qualification requirements 
of Paragraph - 2500 of ASME Code Case N-729-1: 

- The specimen set shall have pipe diameters within Vi in. (13 mm) of the nominal diameter of 
the qualification pipe size and a thickness tolerance of +25%, -40% of the nominal through- 
wall depth of the qualification pipe thickness. The specimen set shall include geometric and 
material conditions that normally require discrimination from PWSCC flaws. 

- The specimen set shall have a minimum of ten (10) flaws which provide an acoustic response 
similar to PWSCC indications. All flaws shall be greater than 10% of the nominal pipe wall 
thickness. A minimum number of 20% of the total flaws shall be outside diameter initiated 
and 30% of the total flaws shall be inside diameter initiated. Further, at least 20% of the total 
flaws are at each of the depth ranges of 10%-30% and 31 %-50% from the inside or outside 
diameter, as applicable. At least 30% and no more than 60% of the flaws shall be oriented 
axially. 

- Procedures shall identify the equipment and essential variable settings used for the 
qualification. An essential variable is any variable that has an effect on the results of the 
examination. The procedure shall be requalified when an essential variable is changed outside 
the demonstration range. Procedure qualification shall include the equivalent of at least three 
personnel performance demonstration test sets. Procedure qualification requires at least one 
successful personnel performance demonstration. 

- Personnel performance demonstration test acceptance criteria will meet the personnel 
performance demonstration detection test acceptance criteria of Table VIII-S10-1 of Section 
XI, Appendix VIII, Supplement 10. Examination procedures, equipment, and personnel are 
qualified for depth sizing and length sizing when the RMS error of the flaw depth 
measurements, as compared to the true flaw depths, do not exceed 1/32-inch (0.8 mm) and the 
RMS error of the flaw length measurements, as compared to the true flaw lengths, do not 
exceed 1/16-inch (1.6 mm), respectfully. 

2.10 Code Case N-770-1 

At the request of the NRC, ASME developed Code Case N-770-1 [45], which provides inspection 
requirements to address PWSCC in Class 1 butt welds containing Alloy 82/182. Code Case N-770-1 has 
requirements for inspection of unmitigated as well as mitigated Alloy 82/182 RCS butt welds. As such, 
specific inspection requirements for welds mitigated by weld overlays (WOLs) are contained in the Code 
Case. The NRC incorporated ASME Code Case N-770-1 by reference into §50.55a (76 FR 36232, 
p. 36278) in June 2011 [46], 

In the US operators of PWRs with dissimilar metal nozzle safe-end welds, which are susceptible to 
PWSCC, are required to examine those welds with increased frequency unless mitigating actions are taken. 
On 26 January 2009, ASME published Code Case N-770, “Alternative Examination Requirements and 
Acceptance Standards for Class 1 PWR Piping and Vessel Nozzle Butt Welds Fabricated with UNS 
N06082 or UNS W86182 Weld Filler Material With or Without Application of Listed Mitigation Activities 
Section XI, Division 1.” On 25 December 2009, ASME modified ASME Code Case N-770 and issued 
version 1 of the code case as N-770-1. Requirements for these examinations are specified in American 
Society of Mechanical Engineers (ASME) Section XI, Code Case N-770-1 as modified by 10CFR50.55a. 

In June 2011, the US NRC issued rulemaking (76 FR 36278) that implemented ASME Code 
Case N-770, “Alternative Examination Requirements and Acceptance Standards for Class 1 PWR Piping 
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and Vessel Nozzle Butt Welds Fabricated with UNS N06082 or UNS W86182 Weld Filler Material With 
or Without the Application of Fisted Mitigation Activities, Section XI, Division 1,” 
10CFR50.55a(g)(6)(ii)(F)(l), effective date 22 August 2011, states "licensees of existing, operating PWRs 
as of 21 July 2011, shall implement the requirements of ASME Code Case N-770-1, subject to the 
conditions specified in paragraphs (g)(6)(ii)(F)(2) through (g)(6)(ii)(F)( 10) of this section, by the first 
refuelling outage after 22 August 2011." 

According to the Code Case, welds in Inspection Items A-l, A-2, and B are required to be examined 
by visual examination and UT. Inspection Item A-l welds, hot leg welds with an operating temperature 
greater than 325°C (i.e. pressuriser nozzle DMWs), are required to be examined visually each refuelling 
outage and volumetrically every second refuelling outage. Inspection Item A-2 welds, hot leg welds with 
an operating temperature less than or equal to 325°C, are required to be examined visually each refuelling 
outage and volumetrically every 5 years. Inspection Item B welds, cold leg welds with an operating 
temperature greater than or equal to 274°C and less than or equal to 304°C, are required to be examined 
visually once per interval and volumetrically every second inspection period not to exceed 7 years. For 
certain components 100% volumetric coverage is required. Examples of such components include the 
pressuriser surge line nozzle and the reactor coolant system cold leg and hot leg nozzles. The Code Case 
770-1 inspection requirements are summarised in Table 1 below. 
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Table 1: Code Case N-770-1 Inspection Requirements Summary 1 


Inspection Item 

Inspection Location 

Extent and Frequency of Examination 


A-l 

Butt welds at Hot Leg operating 

BMV examination each refuelling outage. Volumetric examination every second 

“2 

C 73 


temperature > 329°C 

refuelling outage. 

^ 13 

< £ 

73 

A-2 

Butt welds at Hot Leg operating temperature 

BMV examination each refuelling outage. Volumetric examination every five 


<329°C 

years. 

s 3 

■a (N 
12 

J3 <N 

hJ oo 

B 

Butt welds at cold leg operating temperature 
> 274°C and < 304°C 

BMV examination once per interval. Essentially 100% volumetric examination for 
axial and circumferential flaws in accordance with the applicable requirements of 
ASME Section XI, Appendix VIII, every second inspection period not to exceed 7 
years. Baseline examinations shall be completed by the end of the next refuelling 
outage after 20 January 2012 



C 

Uncracked butt welds reinforced by a full 

If volumetric examination is not performed on the weld prior to FSWOL, the weld 



structural weld overlay (FSWOL) of Alloy 

shall be assumed cracked and shall be classified Inspection Item F. If cracking is 



52/152 material 

not observed during post-FSWOL preservice volumetric examination performed 
from the outside surface of the overlay, axial and circumferential cracks at least 

C/3 



75% through the original wall thickness are required to be assumed. Inspection 
Item C welds are required to be placed in a population to be examined on a 25% 

£ 



sample basis. A once-per-interval inspection frequency applies to this sample. 


D 

Uncracked butt welds mitigated by 

No visual inspection requirements. Volumetric examination shall be performed 

CQ 

<N 

OO 


mechanical stress improvement process 
(MSIP®) 

within 10 years following stress improvement. If the examination volumes of the 
welds show no indication of cracking, the welds shall be placed into a population 

CN 

OO 



to be examined on a sample basis. Twenty-five percent of this population shall be 
examined once each interval. 

o 

< 

73 

to 

E 

Cracked butt welds mitigated by MSIP® 

No visual inspection requirements. Volumetric examination shall be performed 
once during the first or second refuelling outage following stress improvement. If 
the examination volumes of the welds show no indication of crack growth or new 

a 

1 



cracking, the welds shall be placed into a population to be examined once each 
interval 


F 

Cracked butt welds reinforced mitigated by 

Inspection Item C welds are required to be placed in a population to be examined 



a FSWOL of Alloy 52/152 material 

on a 25% sample basis. A once-per-interval inspection frequency applies to this 
sample. The FSWOL technique results in effective mitigation and that inspection 
of FSWOLs serves a defence-in-depth monitoring function rather than a 
degradation management function 


1. For full details on the N-770-1 inspection requirements and NRC conditions for its use, go to www.nrc.gov/reading-rm/doc-collections/cfr/part050/part050- 
0055a.html 
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Inspection Item 

Inspection Location 

Extent and Frequency of Examination 


G 

Uncracked butt weld mitigated with an inlay 
of Alloy 52 or Alloy 152 material 

A volumetric examination shall be performed immediately before application of 
inlays or onlays and after application as a preservice baseline inspection. 
Volumetric and surface examinations shall be performed no sooner than the shorter 
of 10 years following the application of the inlay or onlay and the design life of the 
inlay or onlay. Examination volumes that show no indication of cracking are to be 
placed into a population to be examined on a sample basis. 

H 

Uncracked butt welds mitigated by a weld 
onlay constructed of Alloy 52 material 

J 

Cracked butt welds mitigated with an inlay 
of Alloy 52 or Alloy 152 material 

Volumetric and surface examinations shall be performed once during the first or 
second refuelling outage following application of the inlay or onlay. Examination 
volumes that show no indication of cracking are to be placed into a population to 
be examined on a sample basis. 

K 

Cracked butt welds mitigated by a weld 
onlay constructed of Alloy 52 material 
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2.11 NDE of small-diameter piping 

This section compares and contrasts certain aspects of the French, Korean and US industry practices with 
respect to socket weld RIM. In 2002 the French regulatory authority, Autorite de surete nucleaire (ASN) 
issued a directive concerning socket weld integrity (DGSNR-BCCN/OT/VF No. 020406 [47]). According 
to this directive, socket welds not meeting the requirements for weld dimensions and/or weld integrity as 
specified by the RCC-M Code [48] “...shall be replaced with butt welds.” In response to the directive by 
ASN, EDF implemented systematic socket weld integrity programme for all of its Class 900 MWe PWR 
plants [49]. 

According to Table IWB-2500-1 of ASME XI, an external surface examination of small-bore Class 1 
piping should be included for piping less than DN100. Other ASME Code provisions are exempt from 
examination piping of size DN25 and smaller. This programme is augmented to include piping from DN25 
to less than DN100. Also, Examination Category B-P requires system leakage test of all Class 1 piping. 
The utilities applying for licence renewal have made commitments to address the requirements of the 
GALL Report [49]. In the absence of an established US industry standard for NDE of small-diameter 
piping, the utilities have implemented their own technical approaches that include the use of phased array 
and conventional shear wave ultrasonic NDE techniques. An overview of selected US NDE practices 
applicable to small-bore piping is documented in Reference [50]. 

In the US, NUREG-1801 (the “GALL Report”) [50] provides a technical basis for determining the 
adequacy of ageing management programme (AMPs) for licence renewal. Section XI.M35 of NUREG- 
1801 augments the requirements in ASME Section XI, 2004 Edition (Rules for ISI of Nuclear Power Plant 
Components). According to NUREG 1801, Gall Revision 2, AMP X1.M35 specifies a one-time inspection 
to detect cracking in socket welds; the inspection should be either a volumetric or opportunistic destructive 
examination [51], Opportunistic destructive examination is performed when a weld is removed from 
service for other considerations, such as plant modifications. A sampling basis is used if more than 1 weld 
is removed. These examinations provide additional assurance that either ageing of small-bore ASME Code 
Class 1 piping is not occurring or the ageing is insignificant, such that a plant-specific AMP is not 
warranted. 

This programme is applicable to systems that have not experienced cracking of ASME Code Class 1 
small-bore piping. This programme can also be used for systems that experienced cracking but have 
implemented design changes to effectively mitigate cracking. (Measure of effectiveness includes (1) the 
one-time inspection sampling is statistically significant; (2) samples will be selected as described in 
Element 5, Monitoring and Trending below; and (3) no repeated failures over an extended period of time.) 
For systems that have experienced cracking and operating experience indicates that design changes have 
not been implemented to effectively mitigate cracking, periodic inspection is proposed, as managed by a 
plant-specific AMP. Should evidence of cracking be revealed by a one-time inspection, periodic inspection 
is implemented using a plant-specific AMP. If small-bore piping in a particular plant system has 
experienced cracking, small-bore piping in all plant systems are evaluated to determine whether the cause 
for the cracking affects other systems. 

In Korea there is an augmented inspection programme concerned with small-bore piping socket 
welds. In 2008, RCPB leakage was reported at a socket weld of 3/4 inch drain line from a steam generator 
(SG) bowl to a SG drain valve. The root cause of the leak was determined as an internal manufacturing 
crack which initiated at the weld root and subsequently had propagated during operation. In the results of 
additional examinations extended to similar socket welds (a total of 37 welds), nine more welds were 
identified to have abnormal indications which were mostly attributed to lack of penetration. The Korea 
regulatory body issued an administrative order to request the licensee inspect all class 1 and 2 socket welds 
of small-bore piping (less than 2-inch) with volumetric examination (especially radiographic testing) at the 
earliest next refuelling outage. In response to that, the licensee performed the requested inspections for all 
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safety-related socket welds and then, developed a small-bore piping (less than 2-inch) socket weld 
management programme [52], 

The small-bore piping socket weld management Programme was developed based on vibration 
measurements at socket welds within the RCPB because the failure mechanism of socket welds is mostly 
attributed to service-induced high-cycle fatigue. By considering the measured level of vibration and 
importance of welds, all socket welds in the RCPB were categorised into three groups: welds with high, 
medium, and low risk significance. For the socket welds with high risk significance, both surface and 
volumetric examination should be performed at every refuelling outage. Since surface examination has not 
been enough for the earlier detection of flaws that mostly initiated inside the socket weld, volumetric 
examination was additionally required. The conventional manual UT, however, has limitations due to the 
limited accessibility to the socket weld and difficulties with contact between the ultrasonic probe and the 
out diameter surface of small-bore piping. In order to overcome the limitations, the Korea licensee 
developed phased array UT system and inspection procedures for small-bore piping and socket welds. The 
phased array UT has been performed since 2003 under the socket weld management Programme [52], 
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3. RIM INFLUENCES IN CODAP 


The CODAP Event Database is a web-based SQL database (i.e. relational database) consisting of 
ca. 100 uniquely defined data fields for each database record. It is a mixture of free-format fields for 
detailed narrative information, fields defined by drop-down menus with key words (or data filters) or 
related tables, and hyperlinks to additional background information (e.g. photographs, root cause 
evaluation reports). The related tables include information on material, location of damage or degradation, 
type of damage or degradation, system name, safety class, etc. The “Online Version” facilitates data input, 
search and query routines and data export to a local computer. On a local computer, the database can be 
converted into a Microsoft® Access database format or any other user-defined format. In this section, all 
figures are based on the Microsoft® Access database version of the database. 

3.1 Database structure and coding guideline 

The CODAP event database is populated by the National Coordinators (NCs) of the member countries. In 
accordance with the Operating Procedures [53] and QA Plan [54], validation of data submissions is 
performed by the respective NC and the Operating Agent. To achieve the objectives established for the 
CODAP event database a coding format has been developed. This coding format is reflected in the Coding 
Guideline (CG) [55]. The Coding Guideline builds on established pipe failure data analysis practices and 
routines that acknowledge the unique aspects of passive component reliability in heavy water reactor and 
light water reactor operating environments (e.g. influences by material and water chemistry). 

Data quality is affected from the moment the field experience data is recorded at a nuclear power 
plant, interpreted, and finally entered into a database system. The field experience data is recorded in 
different types of information systems ranging from action requests, work order systems, ISI databases, 
outage summary reports, licensee event reports, and reportable occurrence reports. Consequently, the 
details of a degradation event or failure event tend to be documented to various levels of technical detail in 
these different information systems. Building a CODAP event database record containing the full event 
history often entails extracting information from multiple sources. 

The term “data quality” is an attribute of the processes that have been implemented to ensure that any 
given database record (including all of its constituent elements, or database fields) can be traced to the 
source information. The term also encompasses “fitness-for-use”, that is, the database records should 
contain sufficient technical detail to support database applications. 

As one of several-steps to ensure data integrity, all relevant source data are retained within the 
database. As one example, the narrative portions of the database retain all of the original event 
descriptions. Furthermore, a provision exists to attach supporting documents to each event record in 
support of independent validation of event classifications. 

In CODAP, a Completeness Index (Cl) is used for database management purposes. It distinguishes 
between records for which more information must be sought and those considered to be complete. Each 
record in the database is assigned a Cl, which relates to the completeness and comprehensiveness of the 
information in the database relative to the requirements of the Coding Guideline. 
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The database structure consists of a single data entry form. The data entry form is organised to capture 
essential passive component failure information together with supporting information. The data entry form 
consists of four areas: 

General failure data: This area represents the minimum required information to characterise an event 
and it includes an event narrative together with details on the affected component (e.g. diameter and wall 
thickness) and system, impact on plant operation, observed through-wall leak rate, and Code Class. 

11. Flaw size information: This area is for recording flaw size (depth, length, and aspect ratio), 
orientation, location of the flaw (e.g. within weld metal, weld heat affected zone or base metal), 
and number of flaws within a specified component boundary. For multiple flaws within a 
specified component boundary, the distance between respective flaws is indicated. 

12. In-service inspection (ISI) information: This area is used to record any relevant information about 
IS1 performed in the past (e.g. date of most recent inspection). Also documented here is 
information regarding ISI Programme weaknesses or failures. Included in this field are results of 
expanded NDEs in response to the identification of a rejectable flaw or to an identified through- 
wall flaw. Information on component-specific NDE qualification is also included in this database 
area. 

13. Root cause information: This area records factors or conditions contributing to a degraded 
condition. Also included in this area is a field for free-format comments on corrective actions, or 
other information of relevance to a specific event. The method and technique of flaw 
identification and sizing is recorded in this area of the database. 

As one example of validation of data integrity, the Operating Agent on a regular basis performs a 
broad set of database queries to identify records with missing information or records that contain errors in 
specific database fields. When errors are identified, the Online Version of the database, via its Workflow 
Area enables a QA Communication directly between the Operating Agent and the National Coordinator. 

3.2 Method of detecting degradation 

The CODAP event database differentiates between the method of flaw detection and the technique of flaw 
detection. The former relates to programme used to detect the flaw while the latter relates to the specific 
process or technology used to detect subsurface and surface flaws. In the online event database, drop-down 
menus include lists of flaw detection methods and techniques. The user of the database may make 
additions to the pre-formatted drop-down menus. 

Illustrated in Figure 1 is an example of how method of flaw detection is classified in the database. The 
given example is concerned with the discovery in 1994 of a degraded pressurised water reactor (PWR) 
pressure vessel head penetration during a scheduled bare metal visual examination (BMV). 

Illustrated in Figure 2 is an example of how technique of flaw detection is classified in the database. 
The given example is concerned with the discovery in 2013 of a degraded PWR pressure vessel head 
penetration during a scheduled BMV examination using Time-of-Flight Diffraction (TOFD) 
UT technology. 
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3.3 High-level CODAP database summary 

A high-level database summary by method-of-detection and plant operational state is given in Figures 3 
through 8. The pipe failure database content is summarised by safety class and plant operational state in 
Figures 3 through 7. The plant operational state refers to the plant status at the time of the discovery of a 
degraded or failed passive metallic component. Summarised in Figure 8 is the database content with 
respect to BWR core shroud weld flaws and PWR reactor pressure vessel (RPV) head penetration (VHP) 
flaws as a function of method and technique of flaw detection. All charts are based on database queries and 
the following nomenclature is used: 

• Control room indication. This term applies to any remote sensing and annunciation of sump 
in-leakage indicating an active pressure boundary leak whether it is in the containment, 
Drywell, Auxiliary Building, Reactor Building or any other area of a nuclear power plant. 
Methods for leak detection include [56]: 

- humidity sensors at specific locations; 

- online surveillance via video camera; 

- containment atmosphere humidity, pressure, temperature sensing; 

- airborne gaseous radioactivity; 

- level or flow into sumps or tanks. 

• Ultrasonic testing examination. This term applies to all UT examination technologies, 
including encoded and non-encoded scanning [57], 

• Visual inspection is used for any informal or formalised visual inspection (e.g. per ASME XI) 
of a pressure boundary for leakage. The inspection may be performed while at-power or during 
a scheduled maintenance or refuelling outage [58]. 

• WOR/IHSI. In CODAP this term applies when a through-wall defect is identified while 
performing weld preparation before applying a weld overlay (WOR). The term also applies to 
event involving the discovery of a through-wall defect while applying an induction heat stress 
improvement (IHSI) process. 

• Part through-wall flaw. Any Code rejectable flaw indication that results in a repair or 
replacement. This term also applies to carbon steel piping for which the measured wall 
thickness during inspection cannot meet 87.5% of the nominal wall thickness specified in the 
ASME Code Case N-480. 

• Pressure boundary failure: 

- Small Feak. The measured through-wall flow rate is < 1 gpm. 

- Feak. The measured though-wall flow rate (v) is 1 < v < 5 gpm. 

- Farge Feak. The measured though-wall flow rate (FR) is 5 < v < 50 gpm. 

- Very Large Leak. 50 < v < 500 gpm. 

- Rupture corresponds to a major structural failure up to and including a double-ended 
guillotine pipe break (DEGB). 

• Pressure testing. Detection of a latent failure through application of a pressure test process. 

The event data sets that are summarised in Figures 3 through 8 consist of self-revealing surface and 
flaws and sub-surface flaws. Summarised in Figure 7 is the CODAP data set on fire protection water 
system pipe failures. It is limited to the US service experience. In the US, NDE of this particular class of 
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piping is governed by the National Fire Protection Association (NFPA) Standard NFPA-25 [59]. In 
addition, many plant owners have implemented owner-defined NDE Programme that are based on risk 
insights from plant-specific internal flooding PSA studies. 

Figures 3 through 8 were generated by invoking cross-tab queries. Respective vertical axis indicates 
pre-defined keywords in the database drop-down menus, and the horizontal axis represents event counts. 
The displayed query results represent the results of an initial step to organise the database for more in- 
depth analysis, if so required. In CODAP, for an event to be attributed to FTA-RIM, the root cause 
analysis must positively refer to the causal factors that contributed to a RIM performance deficiency. 
Examples of such causal factors include the following: 

• A volumetric examination of the failed component was performed during the last scheduled IS I 
but failed to detect and/or record a pre-existing flaw that, based on a subsequent metallographic 
examination must have been present at the time of the ISI. 

• Application of too coarse UT-grid fails to identify a thinned area prior to failure. 

• Additional examples are given in Section 4.2. 

The through-wall leaks are detected by various types of sensors, by plant personnel performing 
routine walk down inspections, or various types of leak or pressure tests. The subsurface flaws are detected 
by the application of various types of non-destructive examination (NDE) techniques. Stress corrosion and 
fatigue failure mechanisms involve incubation, crack initiation and crack growth. The objective of NDE is 
to detect flaws before crack growth exceeds a pre-determined value. Leak events in the database that 
involve safety-related components could be interpreted as being manifestations of LTA-RIM. For example, 
ISI performed during past inspection intervals could potentially have missed detecting a pre-existing flaw. 
On the other hand, crack initiation could occur between intervals. 

The CODAP event database selectively tracks ISI histories. For detailed ISI histories to be developed 
it is necessary to research past ISI summary reports to determine when a certain weld flaw was first 
identified and whether crack growth beyond a certain wall depth could have been prevented. It is a 
formidable task to establish complete and comprehensive ISI histories for all events in the database and is 
well beyond the current scope of the PRG work plan. Nevertheless, where information on failures of leak 
detection or LTA-RIM is readily available, for example, via root cause analysis reports, then that 
information is recorded in the database. In the current version of the database about 4.6% of all events have 
enough information to establish that they are attributed to LTA-RIM to properly detect a flaw before 
exceeding some pre-determined value. One way of interpreting this database insight would be to say that 
an upper bound (95 th percentile) probability of detection is on the order of 95% based on field experience 
data alone. While outside the scope of work for this topical report, further data processing is required to 
reach more in-depth qualitative and quantitative insights about RIM reliability. Two examples of how 
LTA-RIM is recorded in CODAP are given in Figures 9 and 10: 

• Figure 9. During an ISI of a dissimilar metal weld in a reactor coolant system hot leg inlet to a 
SG nozzle at a US PWR, several axially oriented flaws went undetected by the manual 
conventional ultrasonic testing (UT) technique. The flaws were subsequently detected as a 
result of outside diameter (OD) surface machining in preparation for a weld overlay. 

• Figure 10. During normal power operation a US PWR experienced a moisture separator reheater 
pipe rupture. The ruptured pipe was included in the owner’s FAC Programme. However, an 
incorrect orifice opening size had been entered into the FAC prediction software, which caused 
the software to incorrectly calculate the pipe wall wear rate. Based on the calculated results the 
failed pipe had not been subject to any volumetric examination. 
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Figure 3: Code class 1 pipe failures by plant operational state and method of flaw detection 1 


1. HSB = Hot Standby; HSD = Hot Shutdown 
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Figure 4: Code class 2 pipe failures by plant operational state and method of flaw detection 
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Figure 5: Code class 3 pipe failures by plant operational state and method of flaw detection 
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Figure 6: Non-code pipe failures by plant operational state and method of flaw detection 
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Figure 7: Fire protection water system pipe failures by plant operational state and method of flaw detection 
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Figure 8: Core shroud weld cracks and vessel head penetration cracks by inspection method and technique 
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Figure 9: An example of failure of UT examination to detect a flaw 
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4. FAILURE OF RIM TO DETECT FLAWS 


The CODAP event database captures events that are attributed to less-than-adequate (LTA) 
implementation of RIM. Mainly, the instances of LTA-RIM have involved deficiencies in an inspection 
process to detect pre-existing flaws before exceeding acceptance criteria. In the database passive 
component failure information is recorded in a tiered manner. First, basic failure information is recorded to 
address the most fundamental information about an event and this includes a free-format event narrative 
that describes the sequence of events, including plant response, consequence, in-plant location of failed 
component, dimensional data, and component type. This is followed by recording the known ISI history, 
including date when the failed component was last inspected, method of NDE qualification if a qualified 
method had been used, and any NDE performance deficiencies or failures. This section summarises 
insights about RIM deficiencies as recorded in the CODAP event database. Also included are examples of 
recent RIM deficiencies, such as failure to select the proper NDE locations, inadequate implementation of 
NDE procedures, and failures in calibration and using the NDE tools. The event histories include the 
findings of associated root cause analyses as recorded in CODAP. 

4.1 An overview of RIM failures in CODAP 

The ASME Boiler and Pressure Vessel Code Section XI, “Rules for In-service Inspection of Nuclear 
Power Plant Components” [9] provides requirements for examination, testing, and inspection of 
components and systems, and repair/replacement activities in a nuclear power plant. The mandatory 
Appendix VIII of ASME Section XI provides requirements for performance demonstration (PD) for 
ultrasonic examination procedures, equipment, and personnel used to detect and size flaws. The ultrasonic 
inspection techniques that were in use in the 1970s had been adapted from the manufacturing industry and 
modified using lessons learnt from fatigue cracking service experience. The ultrasonic examination rules 
were prescriptive and were not based on the degradation mechanisms. The non-destructive examinations 
(NDE) were not quantified via testing. The early field experience showed that improvements in inspection 
requirements were needed. Therefore, the NRC sponsored R&D to assess non-destructive examination 
(NDE) reliability. The results indicated that a performance-based testing approach would be the most 
effective means for achieving the needed improvements in reliability [10]. 

As already stated, the CODAP event database captures instances of LTA-RIM, that is events where 
pre-existing flaws have not been identified before exceeding acceptance criteria. In the database passive 
component failure information is recorded in a tiered manner. First, basic failure information is recorded to 
address the most fundamental information about an event and this includes a free-format event narrative 
that describes the sequence of events, including plant response, consequence, in-plant location of failed 
component, dimensional data, and component type. This is followed by recording the known ISI history, 
including date when the failed component was last inspected, method of NDE qualification if a qualified 
method had been used, and any NDE performance deficiencies or failures. Finally, details about the service 
environment (e.g. water chemistry, stresses, pressure and temperature) are recorded as a lead-in to details 
from root cause evaluations (flaw data, chemical composition of material, results of metallographic 
examinations, apparent and underlying causes of material degradation). When RIM fails to detect flaws one 
or more of the following factors are often present: 
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• Accepting a rejectable flaw indication for continued operation. This could be due to 
misinterpretation of NDE results. 

• Misinterpreting flaw signals by qualified personnel due to complexity of the examination (for 
example, when several embedded flaws are stacked together and appear to be connected). 

• Rationalising away detected defects. 

• Using an improperly qualified NDE technique. 

• Poorly implementing an owner-defined inspection programme. 

• Missing a flaw with a qualified procedure. 

• Allowing human factors to influence results.[60] 

- time pressure; 

- tedium; 

- perceptional (or in attentional) blindness. 

The CODAP database content with respect to piping-related LTA-RIM events is summarised in 
Figures 11 and 12. In Figure 11, the LTA-RIM data is organised by time period. The absolute number of 
instances of LTA-RIM has remained largely the same over the past three decades. This observation is to be 
contrasted with the fact that the overall number of inspections have increased significantly over this time 
period. 

In Figure 12, the LTA-RIM data is organised by failure mechanism and mode of failure. The term 
“flow-assisted degradation” includes the following degradation mechanisms: erosion-cavitation, erosion- 
corrosion and flow-accelerated corrosion. 

Figure 13 is a summary of pipe failures that have been discovered through application of a formal 
pressure test process, including hydro testing. The through-wall flaws in Code Class 1 and components that 
have been detected through a pressure test are manifestations of latent failures that were not previously 
discovered through liquid penetrant testing or UT examination. 
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Figure 11: LTA-RIM events by time period 
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Figure 12: LTA-RIM by failure mechanism and failure mode 
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DN25 < 0 < DN50 


DN50 < 0 < DN100 DNIOO < 0 < DN250 
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Figure 13: Through-wall class 1 pipe flaws discovered through pressure test 
4.2 Selected (1999-2015) RIM failures 

Despite the great progress that has been made with non-destructive examination, the detection and 
assessment of crack indications continue to pose challenges, some of which are directly related to the NDE 
techniques, personnel and equipment deployed and some of which are not. Many of the reviewed events 
that involve failure of RIM to prevent passive component material degradation to exceed acceptance 
criteria are attributed to human factors issues. Examples of (1999-2015) RIM failures include the following 
selected events 1 : 

• German PWR Unit, May 2015. At the conclusion of the annual refuelling outage plant 
personnel performed a scheduled operability test of a block valve in the Main Steam pressure 
relief system. The reactor was in hot shutdown at the time of the test. Shortly after the test 
commenced control room personnel received high-temperature alarms and fire alarm indicating 
a sudden steam release. Subsequent inspections noted a DN50 drain line off of one of the relief 
had ruptured. During power operation the drain line is not pressurised. The root cause analysis 
noted that the failed line had never been subjected to NDE. 

• US PWR Unit, May 2015. The control room operators heard the sounds of rushing air or steam 
in the turbine building and began an investigation. The operators observed steam on the turbine 
deck and began a controlled power decrease. At approximately 30% reactor power the operators 
initiated a manual reactor trip in accordance with plant procedures. Once the plant was shut 
down workers isolated the condenser and cooled the reactor using the atmospheric relief valves. 
The cause of steam release into the turbine building was a ruptured 4-inch diameter pipe. The 
pipe rupture caused the fire suppression system to actuate. The failed elbow in the 4-inch piping 
was 10.25 inches downstream of a restricting orifice. This orifice, which restricts the amount of 


1. These descriptions have been extracted from the CODAP event database. 
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scavenging steam drawn from the second stage reheater tube bundle outlet header, was 
modelled in the FAC software as having an opening 3.0 inches in diameter when vendor 
drawings showed an orifice opening of 0.859 inches. The incorrect orifice opening size was 
entered in the FAC software in the 1987 to 1989 time frame during initial FAC software 
database development, and caused the FAC software to incorrectly calculate the wear rate of the 
elbow. Because of this incorrectly calculated wear rate, no wall thickness measurements were 
performed directly on the failed elbow. 

• US PWR Unit, April 2014. While performing planned inspections of reactor coolant system 
piping welds, two flaw indications were identified on a 1.5 inch High Pressure Safety Injection 
Fine connection to the reactor coolant system piping (cold leg). After confirmatory inspections 
and evaluation, one of the two flaw indications was determined to not meet the acceptance 
criteria specified in ASME Section XI. This flaw was missed during the previous refuelling 
outage as a result of a probable skill-based human performance error. The flaw was detected 
during normal inspections required by the NDE augmented examination programme, which is 
driven by EPRI MRP-146 ("Thermal Fatigue in Normally Stagnant Non-Isolable reactor coolant 
system Branch Fines") [61]. Non-isolable branch lines connected to the Reactor Coolant System 
are susceptible to high-cycle thermal fatigue if exposed to specific operational conditions and 
configurations. Examples of susceptible locations are horizontal lines where in-leakage past a 
valve is present and lines that see turbulent swirl penetration from adjacent piping flow. Initial 
MRP-146 inspections were performed in 2008 and did not include the area where the flaw was 
discovered. 

• US PWR Unit, November 2013. Following a controlled shutdown in response to a RCPB leak, 
visual inspection confirmed that the leak was located on a High Pressure Injection Fine. The 
root cause evaluation determined that a crack-like indication in the failed location had existed 
since 2011. Furthermore, the root cause evaluation concluded that inadequate procedural 
guidance existed for the conduct of augmented examinations and appropriate disposition of UT 
examination results where conditions limited the weld volume that could be examined. A UT 
limitation is defined as any obstruction or condition that limits the extent of angle beam 
scanning or limits the extent of required coverage using straight beam scanning. When adequate 
weld volumes could not be examined on the nozzle safe end-to-pipe butt weld, no procedural 
guidance provided weld volume acceptance criteria or directed these limitations to be entered 
into the corrective action programme for evaluation. During the root cause investigation, 
metallurgical analysis documented that the crack propagated over several operating cycles. 
Historical NDE data revealed that the crack was visible in existing radiographs. Had the failed 
weld volume been adequately interrogated, the crack would have been identified before 
propagating through wall. The licensee reviewed the results of the previous UT examination 
performed in 2012 using a NDE procedure and found no reportable indications. However, in 
2011, the licensee performed a radiographic examination specifically to check the condition and 
position of a thermal sleeve. The focus of the review was limited to that area; however, the safe 
end area containing cracked weld was incidentally visible on the film. Following the current 
event, the licensee re-re vie wed the 2011 radiographic film and a crack-like indication was 
identified in the side wall image of the weld at approximately the same location as 
corresponding to the current crack location. From the re-review of the film, this crack-like 
indication appeared to be approximately 50% through-wall. 

• US PWR Unit, March 2012. During an ISI of a dissimilar metal weld in an inlet (hot leg) SG 
nozzle, several axially oriented flaws went undetected by the licensee’s manual conventional 
ultrasonic testing (UT) technique. The flaws were subsequently detected as a result of outside 
diameter (OD) surface machining in preparation for a full structural weld overlay. The 
machining operation uncovered the existence of two through-wall flaws, based on the 
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observance of primary coolant water leaking from the DMW. Further ultrasonic tests were then 
performed, and a total of five axially oriented flaws, classified as PWSCC, were detected in 
varied locations around the weld circumference. The particular hot leg safe end-to-nozzle weld 
configuration has an approximate 11 -degree OD taper from the thinner austenitic piping side, up 
to the thicker carbon steel nozzle, and is typical of a DMW created during SG replacement at 
Westinghouse-designed nuclear power plants. However, the level of OD taper exhibited by this 
particular design was not included as a blind performance demonstration mock-up used by the 
PD1. In response to this event, the US industry established the “NDE Improvement Focus 
Group” (N1FG) [62], 

• Korea PWR Unit, January 2011. During full power operation, an operator found large amount 
of steam leak due to a pipe rupture. The ruptured location was a drain line tee-end from the first 
stage of a moisture separator reheater (MSR) to a high pressure feed water heater. The rupture 
of the tee-end was attributed to erosion due to liquid droplet impingement of two-phase flow. 
Although the MSR system is subjected to the licensee’s FAC management programme, the 
failed location had been exempted from the programme because it satisfied the exempt 
condition of stagnant flow during normal operation. After the event, similar locations have been 
included in the FAC management programme. 

• Korea PWR Unit, May 2011. Another unit also experienced a pipe rupture at a vent pipe of 
MSR first stage reheater to a high pressure feed water heater during full power operation on 
May 2011. The ruptured length was estimated about 15 cm on the straight line below a 
45-elbow. The ruptured location had not been subjected to the licensee’s FAC Programme, 
though an adjacent elbow has been inspected. Another cause of the failure was attributed to the 
change of operating conditions due to the replacement of the MSR internals (May 1996) and the 
power uprate (2009). The changes accelerated FAC at the failed location. Focations of FAC 
inspection should have been re-determined by taking account of the changed operating 
conditions. 

• German PWR Unit, December 2010. An automated ultrasonic ISI was performed on the nozzle 
of the reactor coolant system Hot Feg connecting to the surge line [63]. This examination 
revealed a circumferential indication in the connecting area of the thermal sleeve at the upper 
end of the radius at the safe end of the nozzle. The indication was detected by means of the 
ultrasonic examination technique 45° ET2 (single-transducer method with transverse waves), 
pointing to the outside wall of the safe end. The indication was fully circumferential; in the 
circumferential region of approximately 330° to 60° beyond the 12 o'clock position, the echo 
amplitude exceeded the recording limit by 5 dB in some cases. 

- A verification measurement with the “52 SET” testing method (dual search unit; transmitter- 
receiver with transverse waves) showed the same indication structure, but the echo 
amplitudes were completely below the recording limit. The indication depth was checked by 
run-time analyses using a phased-array probe. The indication depth determined this way was 
about 2.7 mm in scanning direction and about 2.2 mm in the opposite direction. All 
ultrasonic testing methods have been qualified using a similar reference test block. 

- Ultrasonic examinations were again carried out during the 2011 outage and the results were 
compared with the previous examination results of 2010. The same examination technique 
as in 2010 was applied. The results showed again a fully circumferential indication of the 
same extent. However, the echo amplitude was 3 dB less compared with the 2010 
measurements. The extent to which the recording threshold was exceeded also corresponded 
to the extent of the 2010 examination. Using the same ultrasonic analysis method as in 2010, 
the indication depth measured this way was again 2.7 mm. 
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- Owing to the change identified in the amplitude of the indication, the examination technique 
was to be reviewed and newly qualified. In addition, an examination technique for 
determining the amplitude of flaws was to be qualified [63], Said qualification was 
performed on a test body of similar geometry and material. Grooves were applied as flaws to 
be used for comparison. The choice of grooves was guided by the relevant regulations and 
was to ensure that the examination technique chosen was capable of detecting the different 
crack depths and assess them with a certain degree of tolerance. In order to be able to 
simulate branching and inclined cracks, too, twisted and tilted grooves were also included. 
The smallest reflector size was 0.5 mm. The evaluation of the qualification measurements on 
the test body showed that the examination technique chosen can detect all reflectors, 
including inclined reflectors, with a sufficient signal-to-noise ratio. However, it was only 
possible to determine the groove depth with sufficient accuracy from a depth of > 2 mm. In 
the case of smaller reflectors, the groove tip was no longer clearly detectable, so that it was 
only possible to determine the extension of the depth of smaller reflectors by estimation. 

- Subsequently, a re-assessment of the (real) indication was carried out with the newly 
qualified analysis technique, and the indication was assessed as being 2 mm deep at the 
most. Since a possible crack growth could not be excluded, the safe end was removed, cut 
and subjected to a metallographic examination. This examination revealed a minute 
circumferential crack which had apparently formed through fatigue as a result of changing 
thermal loads. Its location corresponded with the results of the ultrasonic examination. The 
actual maximum depth of this minute crack was, however, clearly below the crack depth 
determined by means of the ultrasonic examination. The maximum depth determined was 
approx. 0.3 mm in 0° position. 

- A visual inspection revealed that the actual geometry of the connecting area of the thermal 

sleeve (radius) deviated clearly from the specifications of the drawing. Instead of a radius of 
2.5 mm, an almost rectangular groove cross-section was found, superposed by geometric 
discontinuities, turning grooves, and chatter marks from manufacture. 

• Korea PWR Unit, April 2007. While performing planned visual inspection and UT thickness 
measurement of the secondary sides of three SGs, a through-wall flaw was identified on the 
feed water ring connection to the .1-nozzle No. 2 in both the SG A and B. In addition, some 
significant wall thinning was also found in the similar area in all three SGs. The flaws and wall 
thinning were attributed to FAC due to the single phase flow of the feed water at the branches of 
the feed water ring to the .1-nozzle. Based on the UT thickness measurement results, affected 
parts of the feed water ring which did not meet the minimum thickness criterion were replaced. 
Although the UT thickness measurement of the feed water ring has been performed in 
accordance with the SG management programme, the failed locations (around feed water ring to 
J-nozzle welds), however, had never been inspected by UT. 

• US BWR Unit, February 2007. During the refuelling outage NDE of dissimilar metal welds in 
the Reactor Recirculation system found surface breaking cracks in two welds’ 55% and 74% 
through-wall. The two welds had been previously inspected in 1999 using an un-qualified 
inspection procedure. Evidence of flaws was present but not called out by the inspection 
personnel. In 2005, the two weld had been re-inspected using a qualified procedure and the 
weld crowns were removed and no flaws were detected. Unacceptable contact was obtained in 
the location of the flaw due to gravity. The flaws were on the bottom of a horizontal pipe. 

• Canadian CANDU Units (multiple instances). Feeder pipes are part of the CANDU (Canadian 
Deuterium Uranium) PHT (Primary Heat Transport) system. Essential function of the feeder 
pipe is to transports heavy water (D20) coolant to and from the fuel channels and the inlet and 
outlet headers in order to cool the fuel bundles in the pressure tubes. The feeder pipe is 
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considered a Nuclear Class 1 piping component and governed by CSA N285.4 on periodic 
inspection of CANDU nuclear power plant components because of containing fluid that directly 
transports heat from nuclear fuel. Two types of cracking are considered as degradation 
mechanisms in feeders: first one being cracking due to stress corrosion cracking (SCC) on the 
tight radius bend/elbow and repaired welds, and the other is cracking due to primary water 
stress corrosion cracking (PWSCC) in Dissimilar Metal Welds (DMWs). In 1997, a through- 
wall crack was detected in the tight radius bend of outlet feeder S08 at CANDU Unit 1. After 
this initial finding, bend cracking in 16 feeders were reliably detected by ultrasonic NDE and 
leak detection system up to the beginning of the refurbishment of CANDU Unit 1. However, in 
2003, a through-wall crack in the repaired field weld of the feeder G09 at CANDU Unit 2 was 
identified by leak detection system but not by NDE. It should be noted that susceptibility to 
cracking on partially repaired welds in the Grayloc region would be higher than the other 
repaired regions (i.e. pipe to header welds and field welds) due to high local residual stress 
along with high operating stress on the repaired Grayloc region. After cracks in these two 
nuclear power plant units were observed, many cracking inspection have been conducted as per 
the inspection programme to capture crack indication on the tight radius bend/elbow, the 
Grayloc weld and repaired Grayloc weld. ISI results indicate that no further crack indications 
have been reported since then. During the refurbishment of CANDU Unit 1, the entire portion 
of feeder piping from the Grayloc hub up to header nozzle was replaced with feeders fabricated 
from improved material SA-106 Grade C, having a low free nitrogen concentration, which is 
less susceptible to cracking and wall thinning. In addition, improved bend fabrication and 
installation method were used to reduce residual stress on the tight radius bend and welds for 
replacement feeders. 

• US PWR Unit, February 2002. In response to Bulletin 2001-01, the plant began a refuelling 
outage with the intent to perform work that included remotely inspecting the VHP nozzles from 
underneath the head focusing on the CRDM. The licensee found that three CRDM nozzles had 
indications of through-wall axial cracking. Specifically, the licensee found these indications in 
CRDM nozzles 1, 2, and 3, which are located near the top of the reactor pressure vessel (RPV) 
head. The licensee attempted to repair these VHP nozzles remotely by approaching from 
underneath the pressure vessel head. On March 6, 2002, the licensee terminated the repair 
process on CRDM nozzle 3 to determine the cause of unusual equipment operation and 
removed the machining apparatus from the nozzle. During the removal, the nozzle tipped in the 
downhill direction until it rested against an adjacent CRDM. If the surrounding steel had been 
structurally sound, it should have held the nozzle in position. The licensee investigated the 
condition of the RPV head surrounding CRDM nozzle 3. The investigation included removing 
the CRDM nozzle and removing large boric acid deposits from the top of the RPV head. Upon 
completing the boric acid removal on March 8, 2002, the licensee conducted a visual 
examination of the area and identified a large cavity in the RPV head on the downhill side of 
CRDM nozzle 3. The corrosion was caused by borated water that leaked from the reactor 
coolant system onto the vessel head through cracks in the nozzle and the weld that attached 
nozzle 3 to the RPV head. The licensee discovered the remaining thickness of the RPV head in 
the wastage area to be about 9.5 mm (3/8 inch). This thickness consisted of only stainless steel 
cladding on the inside surface of the RPV head, which is nominally 9.5 mm (3/8 inch) thick. 
The stainless steel cladding is resistant to corrosion by boric acid, but it is not intended to 
provide structural integrity to the vessel. Failure of the stainless steel cladding would have 
resulted in a loss-of-coolant accident (LOCA). 

• Korea PWR Unit, March 1999. During the refuelling outage, wall thinning that did not meet the 
minimum thickness requirement was found in main feed water straight piping. The thinned area 
was located near the containment penetration area. All weld points of main feed water piping 
from the containment penetration up to the main isolation valve should be 100% inspected 


58 



NEA/CSNI/R(2017)3 


every 10 years according to the commitment in FSAR chapter 3.6 of the unit. Although all 
welds near the thinned area had been inspected by UT and MT, the examination had been 
focused to fining flaws in the welds, missing the wall thinning. Other Korean PWR units also 
experienced the same event on main feed water piping near containment penetrations. The 
detailed investigation showed that the wall thinning of the main feed water straight lines was 
attributed to a deficiency in material design. 

• German Experience with Qualification of UT Technique for Nozzle Weld Seams. Owing to a 
stipulation in the regulations, an examination technique was to be developed for examinations 
of austenitic nozzle weld seams for operationally-induced deficiencies [64]. This examination 
technique was to be capable of finding the stipulated reflectors and assessing them according to 
the amplitude criterion. The technique was optimised using a test body with applied grooves 
and artificial reflectors. All reflectors in the test body could be detected and assessed with the 
required accuracy. 

When the examination technique was used for the first time on a real test object, reflectors were 
detected whose flaw pattern did not indicate cracks. Subsequently, the magnitude of the detected 
reflectors was to be determined, and it was to be clarified whether there was a connection of the 
reflector to the outer surface. The magnitude determined initially lay within the lower range of 
the comparative reflectors. 

In order to be able to make a better statement on the magnitude of the reflector, the examination 
technique was optimised by various measures. Among other things, efforts were undertaken to 
focus on the area of the position of the reflector. In order to achieve this, computerised focusing 
with the help of the SAFT algorithm (see Glossary of Technical Terms) was used. This 
optimisation was carried out on the test body with the artificially applied reflectors. By re¬ 
assessing the measured data using the SAFT algorithm, it was possible to put the indications in 
concrete terms and achieve an improvement of the accuracy when assessing the reflectors present 
in the calibration block. The smallest reflector examined in this way had a height amplitude of 
3 mm and was located at a distance of 2 mm from the outer surface. 

Despite the improvements that were made, it was still not possible to assess the indications 
detected on site clearly. To clarify the facts nevertheless, comparative measurements were carried 
out on a comparable real part in the Gemeinschaftskernkraftwerk Tullnerfeld (GKT nuclear 
power plant) 2 . By carrying out measurements with the same ultrasonic examination technique it 
was possible to identify indications that were absolutely comparable with the indications on site 
with respect to their pattern. The assessment of one of these indications with the help of SAFT 
showed a height amplitude of 2.5 mm. Metallographic examinations of the removed sample 
clearly characterised the reflector as a manufacturing flaw (weld imperfection). The height 
amplitude determined by metallographic examination was 0.35 mm. 

The discrepancy between the actual height amplitude and the one determined by means of SAFT 
was explained by the fact that the examination technique was optimised for the assessment of 
flaws with a height amplitude of more than 2.0 mm. No comparative values existed for smaller 
reflectors. If one wants to assess even smaller reflectors, correspondingly smaller comparative 
values are needed for the qualification of the examination technique. Here, there is a limit as it is 
very difficult to generate clearly defined smaller artificial reflectors. 


2. Also referred to as Kernkraftwerk Zwentendorf; a BWR Type 69 designed by AEG-KWU, completed in 1978 but 
it never obtained an operating license. The BWR unit is located in Niederosterreich, Austria. 
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4.3 Data analysis insights regarding LTA-RIM 

A review of the CODAP event data shows that LTA-RIM occurs when detected flaws area rationalised 
(i.e. the flaws are not seen as recordable) or RIM procedures are not implemented in an optimum manner. 
Based on the operating experience data: 

• No inspection procedure can succeed if a detected indication is rationalised away. 

• When qualified procedures are used appropriately, ultrasonic inspections have shown to have a 
high reliability. 

• The reliability of inspection procedures declines sharply when the procedures deviate from the 
qualified procedures. 

• If the regulatory and industry goal is to prevent leakage RIM will need to be implemented in 
new areas. 

The service experience data in CODAP indicates that RIM reliability challenges continue to exist. 
New inspection requirements are implemented that apply to visually inaccessible piping or materials 
(e.g. cast austenitic stainless steel) for which qualified NDE technology is being developed. 

The examples in Section 4.2 show the limits of today's performance capability of RIM. Current UT 
technology enables the detection of very minor discontinuities. With respect to the NDE qualification 
process, it is concluded that the validity limits within which an examination technique will produce reliable 
results are clearly defined. In practice, attempts are made (as shown in the examples above) to assess 
indications that may be outside the validity scope. This can lead to a marked overestimation of smaller 
flaws. 

The examinations have shown that even the smallest reflectors can be detected with a large signal-to- 
noise ratio. From a safety-related point of view, overestimating the size of flaws means that one is on the 
safe side. However, in the case of the “German PWR Unit, December 2010” it has been shown that a 
considerable overestimation of the magnitude of the indications may lead to measures that may be counter¬ 
productive. Besides the already explained differences between the reflectivity of artificial flaws (grooves) 
and natural faults (cracks), other possible sources for wrong assessments may also be differences in the 
geometry of the calibration block and the real component. 
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5. ASSESSMENT OF INFLUENCE OF RIM ON PASSIVE COMPONENT RELIABILITY 


A database like CODAP provides qualitative and quantitative insights regarding the effectiveness of RIM 
Programmes. The effectiveness of RIM can be characterised by the reliability of leak detection and non¬ 
destructive examination (NDE) programme implementation. The latter factor is defined by the probability 
of detecting (POD) a subsurface flaw of certain dimension (e.g. length and depth). POD is not an easily 
measured quantity. It is usually inferred from experiments such as performance demonstration data. In 
theory, POD values can be derived from operating experience data but a statistical analysis requires 
detailed information on the total number of inspection performed across the total plant population. This 
section documents basic principles of how to account for RIM effectiveness factors in structural reliability 
analysis. The focus is on risk-informed principles and the application of statistical models of structural 
integrity. Also included is a summary of POD assessment results. 

The statistical models and tools presented in this chapter could be used in analysing the event data of 
CODAP database or other similar event database for finding interactions between degradation and damage 
mechanisms, for defining the probability that flaw is found in inspection, and for identifying effective 
detection and repair strategies which help mitigating the progression of cracks or leaks to major structural 
failure. The models and tools presented in this chapter are examples of how to establish an analytical 
“bridge” between the CODAP database and passive component reliability analysis. 

5.1 Problem statement 

Extensive service experience data exists on passive component degradation and failure. Given that the 
available data is recorded and classified in a systematic and comprehensive manner, possibilities exist to 
correlate the failure data with the RIM strategies that were present at the time of failure. With detailed 
knowledge of the relationships between different leak detection technologies and RIM strategies 
opportunities present themselves for determining quantitatively the achievable level of risk reduction given 
the current state-of-practice in NDE qualification and RI-ISI. 

The effect of implementing a RI-ISI Programme is to alter the number and effectiveness of locations 
that are inspected in relation to existing programme such as ASME Section XI. The impact of the 
inspection strategies on a specific location could include adding locations to the inspection programme, 
removing locations, or changing the effectiveness of the programme. When an element is selected for 
inspection the effectiveness of the programme is expected to increase because of the knowledge gained 
from the RI-ISI evaluation to determine which degradation mechanisms are most likely to be present at 
that location. Hence when the strategy is switched from an existing inspection programme to RI-ISI, there 
are three possibilities for each location to change its rupture frequency: 

• If the location was inspected in the existing programme and the effectiveness of the programme 
is improved, the change in the pipe rupture frequency, if any, would be to reduce the pipe 
rupture frequency due to the capability to inspect for the most probable degradation 
mechanisms. 
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• If the location was not inspected in the existing programme but added to the RI-ISI Programme, 
as frequently occurs in medium or high risk segments, the pipe rupture frequency will decrease. 

• If the location was inspected in the existing programme and not retained in the RI-ISI 
Programme, there may be increases in pipe rupture frequency. 

The integrity management factor I ik as defined in Section 1.3 accounts for the probability of a certain 
RIM to successfully identify a flaw POD and the effectiveness of a leak detection system to identify a 
minor through-wall pipe flaw before exceeding any plant operational limits. The integrity management 
factor can be determined on the basis of NDE qualification data, expert judgement or field experience data 
such as that contained in the CODAP event database. This model of piping reliability enables a quantitative 
assessment of the level of risk reduction that is achievable with RI-ISI. Markov modelling may be used to 
determine the integrity management factor for different types of 1ST 


5.2 Models of RIM reliability 


Markov modelling enables the analysis of interactions between degradation and damage mechanisms that 
cause pipe failure, and the inspection, detection and repair strategies that can reduce the probability that 
failure occurs, or that cracks or leaks will progress to major structural failure before being detected and 
repaired. This Markov modelling technique starts with a representation of a “system” in a set of discrete 
and mutually exclusive states. The states refer to various degrees of piping system degradation; that is, the 
existence of flaws, leaks or major structural failure. The flaws can be pipe wall thinning or circumferential 
cracking of a weld heat affected zone. Figure 14 is a representation of a general four-state Markov model 
of piping reliability. 


Piping Reliability States: 

S = Success (or undamaged state); 

C = Crack (non-through wall flaw); 

F = Leaking through-wall flaw (leak rate is within 

Technical Specification limit); 

L = Large leak (leak rate in excess, or well in excess of 
Technical Specification limit). 

State Transitions: 

</> 

Occurrence of non-through wall flaw 

4 s 

Occurrence of small leak given an undamaged state (‘S’) 

4 c 

Occurrence of small leak given a flaw (‘C’) 

Ps 

Occurrence of large leak given no flaw 

Pc 

Occurrence of large leak given a non-through wall flaw 

Pf 

Occurrence of large leak given a small leak 

p 

Detect and repair a through-wall flaw 

CO 

Inspect and repair a non-through wall flaw 



Figure 14: Markov model of piping reliability 


The state transition parameters of the Markov model can be estimated directly from service data. The 
model can be used to investigate the time dependence of pipe failure frequencies and the impact of 
alternative ISI and leak inspection strategies. With the integrity management factor associated with the new 
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(i.e. RI-ISI) programme and old programme denoted as respectively /, ;Vciv and I,-, ow the following definitions 
are applied: 


h 40 {RIISI} 
h 40 {noinsp} 


(5.1) 


h 40 { SecXI } 
h 4Q {noinsp } 


(5.2) 


Where 


h 4 o{RIISIj = hazard rate (or time-dependent rupture frequency) at the end of a 40-year design life for 
weld subjected to the RI-ISI inspection strategy 

h 40 {Original Pgm} - hazard rate for weld subjected to the Section XI inspection strategy 

h 40 {noinspj = hazard rate for weld subjected to no ISI 

These hazard rates are a function of time and the parameters of the Markov model in Figure 14. 
According to this figure, there are six parameters that are associated with the Markov model, an occurrence 
rate for non-through-wall flaws, <f>, failure rate for leaks given the existence of a flaw, X F , two rupture 
frequencies including one from the initial state of a flaw p c , and one from the initial state of a leak, p F , a 
repair rate for detectable flaws, co and a repair rate for leaks, p. The latter two parameters dealing with 
repair are further developed by the following simple models. 


P FI x POD 

( J fi +t r ) 


M = 


C T u +T r ) 


(5.3) 

(5.4) 


Where 

P F i = Probability that a piping element with a flaw will be inspected per inspection interval. This 
parameter has a value of 0 if it is not in the inspection programme and 1 if it is in the inspection 
Programme. 

POD = Probability that a flaw will be detected given the weld of concern is inspected. This value is 
based on engineering judgement, NDE qualification data or on field experience data. 

T F i- Mean time between inspections for flaws (“inspection interval”) 

T r = Mean time to repair once detected. There is an assumption that any significant flaw that is 
detected will be repaired. Depending on the location of the weld to be repaired, the weld repair could take 
on the order of several days to a week. Since this term is always combined with T FI , and T FI is 10 years in 
AS ME XI, in practice the results are insensitive to assumptions regarding T R 

P L d = Probability that the leak in the element will be detected per leak inspection or detection 
period 
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T u = Mean time between inspections for leaks. For RCPB piping, the time interval between leaks 
can be essentially instantaneous if the leak is picked up by radiation alarms, to as long as the time period 
between leak tests performed on the system. All ASME Class 1, 2, and 3 piping must be tested for leaks at 
least once per refuelling outage. 

T r =The minimum of the actual repair time and the time associated with any limiting condition for 
operation if the leak rate exceeds technical specification requirements. 

The root parameters of the Markov model in Figure 14 are obtainable directly from the CODAP event 
database (i.e. parameters c|), X and p) or are based on the particulars of an IS1 Programme. Reference [65] 
includes an example of how to estimate the Markov model parameters. The results of an application of the 
Markov model are displayed in Figure 15. This example involves a BWR Reactor Recirculation system 
and shows how different assumptions about the POD affect the calculated time-dependent small FOCA 
frequency. 



Figure 15: Influence of POD on structural integrity 3 
5.3 Probability of detection 

Probabilities of detection (POD) curves are used to quantify the reliability of NDE systems. These curves 
are developed from performance demonstration data and a typical statistical model used for processing the 
data is the logistic model [16] [66][67][68][69], which expresses the POD a flaw of size x as: 

POD(x) = [exp(pi + 02x)]/(l+[atp(pi + 02x)]) (5.5) 


3. This analysis was originally performed in support of NUREG-1829 (“Estimation Loss-of-Coolant-Accident 
Frequency Through the Elicitation Process,” 2008). 
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The two parameters p t and /T are estimated by a fitting procedure to determine the POD curve. Two 
types of POD-curves are used: 1) POD related to a specific NDE technique, and 2) POD related to a 
specific NDE procedure. A NDE procedure describes the process for how to perform a specific type of 
NDE, and it also includes documentation of the underlying qualification. Due to variability in the 
inspection system and other system related properties, an inspection system can only detect a certain range 
of defects. The POD curve for the inspection procedure shows the probability of detection when using 
certain inspection techniques. In general the detection probability for the inspection procedure will be 
lower than for the inspection technique, since the POD curve for the inspection technique assumes an ideal 
defect resolution. Various types of human factors influences are incorporated in the inspection procedure 
related POD curve. 

In risk-informed piping reliability applications efforts are made to apply real-life data pertaining to 
occurrence rates of flaws and observed NDE and leak detection performance measures to obtain realistic 
assessments of piping reliability. What, if any, role do POD-curves have in risk-informed piping 
reliability? For specific, well defined analysis cases POD-curves provide good indications of the variability 
in projected NDE performance. In other words, the POD-curves enable an uncertainty treatment of 
different sets of NDE techniques and processes. Next, the qualitative and quantitative information on NDE 
performance embedded in CODAP could be applied in a Bayesian analysis framework to account for the 
uncertainties in the integrity management factor. 
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6. SUMMARY AND CONCLUSIONS 


6.1 Summary 

Effectiveness of reliability and integrity management (RIM) practices was selected as the subject of the 
third CODAP topical report. The report addresses selected international practices with respect to pressure 
testing, leak detection, in-service inspection (ISI) including non-destructive examination (NDE), and 
performance demonstration initiatives to improve the reliability of NDE techniques. The purpose of RIM is 
to prevent the occurrence of piping through-wall leaks as well as to monitor passive metallic component 
degradation. RIM Programme can utilise risk insights to augment or enhance existing deterministic 
integrity management programme. Through a systematic examination of the operating experience as 
recorded in the CODAP event database, the field experience with the different RIM strategies has been 
evaluated in order to primarily draw qualitative insights about integrity management reliability. 

6.2 Conclusions 

The third topical report documents how RIM strategies are accounted for in the CODAP event database. 
According to the CODAP Coding Guideline that has been prepared by and adopted by the PRG, for each 
record an evaluation is performed of the various RIM influences that have played a role in preventing or 
contributing to a structural failure. Hence, the database includes a significant volume of in-service 
inspection (ISI) information from which valuable insights about RIM performance issues can be drawn. It 
is quite clear that RIM very significantly contributes to a high-level of structural integrity. The operating 
experience insights also point to RIM implementation challenges. 

The CODAP event database captures instances of LTA-RIM, including failures in detecting pre¬ 
existing flaws before exceeding acceptance criteria. CODAP uses a broad definition of LTA-RIM” in that 
the term is defined as events where degradation has progressed beyond acceptable limits in systems, 
structures or components (SSCs) that have a RIM Programme. These LTA-RIM events have some safety 
significance. In this topical report the LTA-RIM definition is broadened to also include events where a 
RIM Programme has resulted in a “false positive”; that is, it has identified degradation that either didn’t 
exist or was not close to violating acceptance criteria. While such events needlessly expend resources and 
could be considered LTA-RIM from an economic perspective, they do not have any safety significance. In 
the database passive component failure information is recorded in a tiered manner. All data submissions 
undergo verification for technical accuracy and completeness in accordance with procedures and protocols 
established by the CODAP-PRG. Lirst, basic failure information is recorded to address the most 
fundamental information about an event and this includes a free-format event narrative that describes the 
sequence of events, including plant response, consequence, in-plant location of failed component, 
dimensional data, and component type. This is followed by recording the known ISI history, including date 
when the failed component was last inspected, method of NDE qualification if a qualified method had been 
used, and any NDE performance deficiencies or failures. Finally, details about the service environment 
(e.g. water chemistry, stresses, pressure and temperature) are recorded as a lead-in to details from root 
cause evaluations (flaw data, chemical composition of material, results of metallographic examinations, 
apparent and underlying causes of material degradation). When RIM fails, one or more of the following 
factors are often present: 
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• Accepting a rejectable flaw indication for continued operation. This could be due to 
misinterpretation of NDE results. 

• Rationalising away detected defects. 

• Using improperly qualified or modified NDE techniques or not selecting the correct procedure 
to implement. 

• Poorly implementing qualified procedures. 

• Poorly implementing owner-defined inspection programme. 

• Not identifying the correct location to inspect. 

• Missing a flaw with a qualified procedure. A procedure may not sufficiently document the basis 
for the examination details used to inspect for a specific, previously observed degradation 
mechanism. There may also be inadequate administrative controls for augmented inspections 
and disposition of inspection results. 

• Experience from examinations in the field allows the conclusion that the sensitivity of advanced 
UT examination techniques is so high that the detection of material flaws, among them also 
crack-like flaws, does not pose a problem in general. The difficulty lies rather more in the 
characterisation and assessment of the indications, especially if these are actually outside the 
validity scope that has been defined for the examination techniques by their qualification. 
Examples from volumetric examinations performed in the filed show that there can be a 
tendency to put greater emphasis on assessing the examining technician's results in the 
“impermissible scope”, which may then lead to large discrepancies between the determined and 
the actual dimensions of the flaw. 

According to the high-level data analysis, the number of instances of LTA-RIM has remained largely 
the same over the past three decades. The rate of LTA-RIM is a function of the number of such instances 
versus the overall number of examinations that have been performed, however. There has been a very 
significant evolution in RIM practices and requirements, and therefore qualified statistical insights 
concerning the reliability of RIM Programme necessitates an in-depth analysis of the field experience data 
as collected by CODAP. 

6.3 Recommendations 

With respect to the continued database development and maintenance (i.e. data submissions and validation) 
it is recommended that the following items be considered in the ongoing active data submission activities 
by the CODAP-PRG Members as well as in the current programme for an enhanced version of the online 
database (“CODAP Option 2” Project): 

• Encourage the PRG Membership to more actively share RIM experience insights. As a standing 
action, future Working Group meetings should focus on technical discussions regarding how to 
utilise CODAP and how to share data analysis insights with the nuclear safety community. 

• Expand the sharing of operating experience data within the PRG. Future Working Group 
Meetings should include as a standing action, national overviews of recent operational events, 
including the findings of root cause analyses. 

• For the PRG Member States that have implemented RI-ISI, add appropriate database fields that 
indicate events that involve reactor components that are included in a RI-ISI Programme. 
Having access to this information would be highly beneficial to future database applications so 
that the database content and inspection programme can be correlated. It is noted that the 
European Network for Inspection and Qualification (ENIQ) has undertaken an evaluation of 
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lessons learnt from the application of risk-informed ISI (RI-ISI) to European nuclear power 
plants. The PRG Membership is encouraged to review this EN1Q effort and to determine how 
conclusion by ENIQ corresponds to the field experience data as recorded in CODAP. 

• Similarly, add appropriate database fields that indicate presence of an augmented inspection 
programme. The basis for this recommendation is as follows: 

- Embedded in the database are examples where an augmented inspection programme is in 
place with the provision that a 100% volumetric examination of a given component 
boundary is to be performed. Yet, through-wall defects have occurred. The underlying 
contributing factors include use of non-qualified NDE technique, or application of too 
coarse UT-scanning matrix. Having the ability to quickly and reliably identify such events 
in the database would greatly enhance the level of user friendliness. 

• Based on the results of the evaluations of the CODAP database content, the number of through- 
wall leakages could be decreased by the following actions: 

Periodic review and independent validation of UT-scanning matrices used in inspection 
piping components; 

RIM Programme optimisation on the basis of probabilistic and risk-informed 
methodologies. 

• The CODAP software is undergoing revision and upgrade. As part of ongoing Programming 
work, the PRG Membership is encouraged to review and modify as needed the definitions of 
Method of Flaw Detection and Technique of Flaw Detection. 
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Notes 


CODAP TOR "Each Participating Country shall submit data and general information on component degradation and failure events in English through its 

_ National Coordinator referred to in Paragraph 16 of the Terms of Reference. _ 

CODAP-OP "The data exchange is carried out through signatories in the participating countries, with the possibility of delegating to other 

_ organizations." _ 


A-1: Database submissions by calendar year and PRG Member 


_QODAP 2nd Term 

_ CODAP 1st Term _^ 

OPDE J * 
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36 
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1 


[ 1 
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1 

1 

2 


12 

DE 

17 

9 

21 

21 

19 

20 

7 

17 

4 

3 

2 

2 


2 


144 

ES 

1 

4 

3 

8 

1 



1 1 


1 


1 




20 

FI 


1 



1 


4 


1 

1 

3 


1 

N/A 


12 

FR 

9 

3 

6 

2 

6 

6 

3 

2 

2 

4 

3 

1 


2 


49 

JP 

111 

39 

14 

6 

14 

10 

13 

K i 

4 

1 

1 

1 




215 

KR 

6 

1 


1 


3 

2 

2 

2 

4 

2 

4 

5 



32 

SE 

1 

7 

4 

1 

1 

1 




1 




N/A 


16 

SK 

1 

1 

1 

1 

1 




2 



2 




9 

TW 


1 



1 


1 

2 


4 

3 

2 

1 

2 


17 

US 

56 

74 

63 

68 

29 

22 

25 

31 

26 

27 

36 

36 

37 

30 

22 

582 


204 

153 

117 

118 

91 

89 

67 

66 

53 

54 

55 

52 

51 

43 

23 

1236 


SCAP-SCC 


A-2: Database Submissions by Project Review Group members and event date 
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Table A-2: OPDE/CODAP data Submission Summary 


Country 

Validation Status as of 30-April-2016 

Total No. 
Records 

Comment 

Approved 

Ready for 
QA 

Ready for 
Review by 
NC 

Draft 

BE 

8 




8 

Participated in OPDE 1 st 
Term 

CA 

202 




202 


CH 

91 


4 

1 

96 


CZ 

25 




25 


DE 

351 



3 

354 


ES 

48 


2 


50 


FI 

55 


2 


57 

2002-2014 PRO 

Member 

FR 

131 


23 


154 


JP 

288 




288 


KR 

70 


1 


71 


SE 

365 


1 


366 

2002-2014 PRO 
Member 

SK 

2 


5 


7 

Joined project in 2011 

TW 

13 


4 

1 

18 

Joined project in 2011 

US 

3065 


24 


3089 


SBH^H 4716 

- 

66 

5 

4787 


81 





NEA/CSNI/R(2017)3 


APPENDIX C 

GLOSSARY OF TECHNICAL TERMS 


Enhanced Visual Examination (EVT-1). The EVT-1 method is intended for the visual examination of 
surface breaking flaws. Any visual inspection for cracking requires a reasonable expectation that the flaw 
length and crack mouth opening displacement meet the resolution requirements of the observation 
technique. The EVT-1 specification augments the VT-i requirements to provide more rigorous inspection 
standards for stress corrosion cracking (SCC). EVT-1 is also conducted in accordance with the 
requirements described for visual examination (i.e. VT-1) with additional requirements (such as camera 
scanning speed). Any recommendation for EVT-1 inspection will require additional analysis to establish 
flaw-tolerance criteria, which must take into account potential embrittlement due to thermal ageing or 
neutron irradiation. Acceptance criteria methodologies to support plant-specific augmented examinations 
are documented in WCAP-17096-NP 1 . 

Full Structural Weld Overlay (FSWOL). A structural reinforcement and stress corrosion cracking 
(SCC) mitigation technique through application of a SCC-resistant material layer around the entire 
circumference of the treated weldment. The minimum acceptable FSWOL thickness is 1/3 the original pipe 
wall thickness. The minimum length is 0.75 \ : (Rxt) on either side of the dissimilar metal weld to be treated, 
where R is the outer radius of the item and t is the nominal thickness of the item. 

Grayloc Region. Inspection area at or near the mechanical connection between a PHTS feeder tube 
and a fuel channel of the CANDU primary system. Grayloc® is a trade name of a type of mechanical 
connector that provides metal-to-metal seals in piping systems. 

Hydrostatic Pressure Test. A pressure test conducted during a plant or system shutdown at a pressure 
above nominal operating pressure or system pressure for which overpressure protection is provided. 

Inclusion. An “inclusion” is a nonmetallic impurity such as slag, oxide, and sulphide that is present in 
the original ingot. During rolling of billets into bar stock, impurities are rolled in a lengthwise direction. 
These direction-oriented inclusions in the finished product are generally referred to as nonmetallic 
inclusions or “stringers”. These stringers may be surface or subsurface and are usually short in length and 
parallel to the grain flow. 

Indication. The definition of the term “indication” as it applies to NDE is: “A response or evidence of 
a response disclosed through NDE that requires further evaluation to determine its true significance.” 

In-service Pressure Test. A system pressure test conducted to perform visual examination VT-2 while 
the system is in service under operating pressure. 

Latent Failure. A degraded material condition that may lie dormant for a long period before leading to 
a visible flaw (e.g. through-wall crack, active leakage). 


1. Westinghouse Electric Company LLC, Reactor Internals Acceptance Criteria Methodology and Data 
Requirements, WCAP-17096-NP, Cranberry Township, PA, December 2009 
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Leak Detection System. Instrumentation and controls that use various temperature, pressure, level and 
flow sensors to detect water and steam leakages in selected reactor systems and to initiate annunciation and 
provide isolation signal (in certain cases) to limit leakage from the reactor coolant pressure boundary when 
limiting leakage conditions exists. 

Leakage Pressure Test. A system pressure test conducted during operation at nominal operating 
pressure, or when pressurised to nominal operating pressure and temperature. 

Less-than-Adequate (LTA). In the context of a root cause analysis of RIM Programme deficiencies, 
the term “LTA” is used to characterise a procedure that lacks something essential to successfully to 
perform an activity. 

Liquid Penetrant Examination. Liquid Penetrant Examination (LPT) uses liquids to detect cracks in 
materials. In the mid and late 1930's, Robert and Joseph Switzer worked with processes incorporating 
visible coloured dyes in the penetrant to give better contrast. In 1941 they introduced processes using 
fluorescent dyes which, when viewed under a black light, produced contrasts superior to those obtainable 
with the visible dyes. The fluorescent method was quickly accepted by the military for aircraft part 
examination. Since then, the use of both colour-contrast and fluorescent penetrants has spread to 
practically all fields of manufacturing, and new and improved PT products are constantly being developed. 

Low-Frequency Electromagnetic Testing (LFET). This technique measures the changes in 
electromagnetic fields while the scanner passes over the metal. Defects and corrosion maps are calculated 
and video displayed in real-time, high resolution, 3-D colour graphics that can be saved for further data 
analysis or permanent record archiving Very low-frequency magnetic signals are not affected by iron oxide 
or any non-magnetic surface deposits which allows for accurate testing on base metals in piping. 

LTA-NDE. As used in this report the term “Less-than-Adequate NDE” implies that deficiencies in the 
implementation of a qualified NDE process have contributed to a reportable or rejectable flaw remaining 
undetected for a certain period. 

LTA-RIM. In this report, LTA-RIM is defined as events where degradation has progressed beyond 
acceptable limits in systems, structures or components (SSCs) that have a RIM Programme. These LTA- 
RIM events have some safety significance. In this topical report the LTA-RIM definition is broadened to 
also include events where a RIM Programme has resulted in a “false positive”; that is, it has identified 
degradation that either didn’t exist or was not close to violating acceptance criteria. While such events 
needlessly expend resources and could be considered LTA-RIM from an economic perspective, they do not 
have any safety significance. 

Mechanical Stress Improvement Process (MSIP®). A patented process that was invented, developed 
and first used in 1986 by NuVision Engineering Inc. for mitigating SCC in nuclear plant weldments. 
MSIP® works by using a hydraulically operated clamp which contracts the pipe on one side of the 
weldment. A typical tool design consists of a specially designed hydraulic box press for bringing the clamp 
halves together. By contracting the pipe on one side of the weldment, the residual tensile stresses are 
replaced with compressive stresses. 

NDE Qualification. In the context of NDE, qualification includes technical justification, which 
involves assembling all the supporting evidence for inspection capability (results of capability evaluation 
exercises, feedback from site experience, applicable and validated theoretical models, physical reasoning), 
and may include practical trials using deliberately defective test pieces. 

Optimised Weld Overlay (OWOL). A subset of the full structural weld overlay (FSWOL) process. It 
has been developed for larger geometries (e.g. RCS hot and cold leg nozzles) where FSWOL application 
becomes too time consuming for a typical refuelling outage. The optimised weld overlay thickness is less 
than that of a full structural weld overlay in order allow completion in the time available in a typical 
refuelling outage for the larger geometries. 
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Probability of Detection (POD). It is the probability that a flaw of a certain size will be detected and it 
is conditional on factors such as wall thickness, NDE personnel qualifications, and flaw orientation. 

Project Review Group (PRG) of the CODAP Project. According to the CODAP Operating 
Procedures, the PRG runs the Project, with assistance from the NEA Project Secretary and the Operating 
Agent. The PRG meets at least once per year. The PRG responsibilities include but are not limited to the 
following types of decisions: 

• Secure the financial and technical resources necessary to carry out the Project; 

• Nominate the CODAP Project chairperson; 

• Define the information flow (public information and confidential information); 

• Approve the admittance of new members; 

• Nominate project task leaders (lead countries) and key persons for the PRG tasks; 

• Define the priority of the task activities; 

• Monitor the progress of the project and task activities; 

• Monitor the work of the Operating Agent and quality assurance. 

Radiographic Examination. A non-destructive testing (NDE) method of inspecting materials for 
hidden flaws by using the ability of short wavelength electromagnetic radiation (high-energy photons) to 
penetrate various materials. 

Reliability and Integrity Management (RIM). Those aspects of the plant design and operational phase 
that are applied to provide an appropriate level of reliability of SSCs and a continuing assurance over the 
life of the plant that such reliability is maintained. 

Root Mean Square (RMS) Evaluation. NDE qualifications include the use of an ultrasonic sizing 
procedure which should be developed and qualified for equipment, technique, and sizing examination 
personnel. At least 10 flawed specimens should be used in the performance demonstration. A RMS 
evaluation should be used to demonstrate adequate sizing performance. This is given by the formula: 

RMS= V(( T-U) 2 /N) 

Where 

T = Truth or actual flaw depth 

U = Ultrasonic flaw depth estimate 

N = Number of test specimens or flaws sized 

Acceptable flaw sizing performance demonstration is achieved when the RMS is 12.5% or less. This 
is comparable to the Appendix VIII criteria proposed in ASME Code Section XI. Accordingly, it was 
demonstrated that at an RMS of 15% or less, acceptable sizing performance is achieved comparable to the 
current EPRI NDE Centre IGSCC, sizing programme. The advanced ultrasonic sizing techniques described 
in this handbook have been developed in accordance with recommended guidelines of the EPRI NDE 
Centre Ultrasonic Planar Flaw Sizing of IGSCC. Variations or modifications of the techniques have been 
incorporated to improve accuracy of flaw depth sizing of stress corrosion, thermal fatigue and mechanical 
fatigue cracks. 

SAFT. Synthetic Aperture Focusing Technique is a signal processing technique which takes advantage 
of the movement of a small conventional transducer to simulate, in effect, a phased array that is extremely 
long. This allows high resolution at long range, with relatively small transducers. SAFT in ultrasonics has 
been around for over 20 years but the amount of processing required has meant that it has had to wait for 


84 




NEA/CSNI/R(2017)3 


developments in computing technology before it can be readily applied. Phased-array techniques have 
developed at a faster pace than SAFT, however. 

Weld Inlay. A mitigation technique defined as application of PWSCC-resistant material (Alloy 
52/52M) to the inside diameter of a dissimilar metal weld that isolates the PWSCC-susceptible material 
(Alloy 82/182) from the primary reactor coolant. 

Unified Numbering System (UNS). An alloy designation system in use in North America. It consists of 
a prefix letter and five digits designating a material composition. For example, a prefix of S indicates 
stainless steel, C indicates copper, brass or bronze alloys. 

VT-1 Examination. A limited visual examination specific to ASME Section XI which is the 
observation of exposed surfaces of a part, component, or weld to determine its physical condition including 
such irregularities as cracks, wear, erosion, corrosion, or physical damage. 

VT-2 Examination. Per ASME XI, a visual surface examination to locate evidence of leakage from 
pressure-retaining components. 

VT-3 Examination. A limited visual examination specific to ASME Section XI which is the 
observation to determine the general mechanical and structural condition of components and their supports, 
such as the verification of clearances, settings, physical displacements, loose or missing parts, debris, 
corrosion, wear, erosion, or the loss of integrity at bolted or welded connections. The VT-3 examinations 
shall include examinations for conditions that could affect operability of functional adequacy of snubbers, 
and constant load and spring type supports. The VT-3 examination is intended to identify individual 
components with significant levels of existing degradation. As the VT-3 examination is not intended to 
detect the early stages of component cracking or other incipient degradation effects, it should not be used 
when failure of an individual component could threaten either plant safety or operational stability. The VT- 
3 examination may be appropriate for inspecting highly redundant components (such as baffle-edge bolts), 
where a single failure does not compromise the function or integrity of the critical assembly. 

Visual Examination. The oldest and most commonly used NDE method is Visual Testing (VT), which 
may be defined as “an examination of an object using the naked eye, alone or in conjunction with various 
magnifying devices, without changing, altering, or destroying the object being examined”. Per ASME XI, 
there are three different VT methods; VT-1, VT-2 and VT-3. 


85 



NEA/CSNI/R(2017)3 


APPENDIX D 

PIPING SAFETY CLASS CROSS REFERENCE TABLE 
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Table D-1: Piping Safety Class Cross Reference Table 1 


USA/ASME Section III 2 

Canada 

(CSA N285.0-95) 

Czech Republic 
(Regulation 214/1997 Sb) 

France (RRC-P 900 R.4) 

Germany (KTA 3201/3211) 

Switzerland (ENSI-GOI/d) 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

1 

Piping that forms the 
RCPB. That is, all 
piping components 
that are part of the 
reactor coolant 

system RCS), or 
connected to the 
RCS up to and 
including any or all of 
the following: 

a) the outermost 
primary 
containment 
isolation valve in 
piping that 
penetrates the 
primary 
containment; 

b) the second of two 
valves normally 
closed during 
normal reactor 
operation in 
system piping 
that does not 
penetrate primary 
containment; or, 

c) the RCS safety 
and relief valves 

1 

Pipe diameter > DN20; 
Sections of systems, or 
systems connected 

thereto, which contain 
fluid that directly 
transports heat from 
nuclear fuel, and whose 
failure would cause a 
LOCA as defined in the 
safety report. 

1 

Equipment of the RCPB, 
except equipment whose 
rupture would result in a 
leakage of a magnitude 
within the capacity of the 
normal coolant make-up 
system. 

1 

RCS and its connecting lines 
with inside diameter greater 
than 10.6 mm for water or 
greater than 21.9 mm for 
steam, up to and including the 
two reactor coolant isolation 
valves. Class 1 piping also 
includes the pressuriser 
letdown line up to and including 
the relief and safety valves. 

1 

For PWRs: 

a) RPV; 

b) Primary side of the 

S/Gs, the secondary 
shell of the S/Gs incl. 
the FW-inlet and MS- 
exit nozzles up to the 
pipe connecting welds 
(excl. small-diameter 
fittings), 

c) Pressuriser, 

d) RCP casing, 

e) Connecting pipes 
between the above 
components and the 
valve casings of any 
type contained in the 
piping system, 

f) Pipes branching off from 
the above components 
and their connecting 
pipes including the 
valve bodies up to and 
including the first shut¬ 
off valve, 

g) Control rod drives and 
the in-core 
instrumentation, 

For BWR: 

a) RPV, 

b) Piping connected to the 
RPV including the valve 
bodies incl. first shut-off 
valve, pipework 
penetrating the 
containment shell incl. 
the last shut-off valve 
located outside the 
containment shell, 

c) Control rod drive and in- 
core instrumentation, 

SK-1 

Pressure-retaining 
boundary of the reactor 
cooling system up to 
the second isolation 
valve or safety valve, 
including small- 

diameter piping and 
pressure-retaining 
parts of 

instrumentation. 


1. This table was prepared by the OPDE-PRG in 2005. It is reproduced from the OPDE/CODAP Coding Guideline/ 

2. The ASME III classification is explained in NRC Regulatory Guide R.G 1.26 (Revision 4, 2007). 

87 





NEA/CSNI/R(2017)3 


USA/ASME Section III 2 

Canada 

(CSA N285.0-95) 

Czech Republic 
(Regulation 214/1997 Sb) 

France (RRC-P 900 R.4) 

Germany (KTA 3201/3211) 

Switzerland (ENSI-GOI/d) 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

2 

Systems or portions 
of systems important 
to safety that are 
designed for 

1) emergency core 
cooling, 

2) post-accident 
containment heat 
removal, or 

3) post-accident 
fission product 
removal 

2 

Pipe diameter > DN20; 
Sections of process 
systems that penetrate 
the containment 

structure and form part 
of the containment 
boundary. 

2 

a) Components creating the 
RCPB, that are not 
ranked as Class 1, 

b) Components for the 
reactor shutdown during 
the abnormal operation 
during the states which 
could lead to the 
accident conditions, and 
for the reactor shutdown 
with the aim to mitigate 
the consequences of 
accident conditions, 

c) Components necessary 
to retain the coolant 
inventory sufficient for 
the core cooling during 
the accident conditions 
when no damage of the 
reactor coolant pressure 
system has occurred, 
and after these 
conditions, 

d) Components necessary 
to remove the core heat, 
when the reactor coolant 
pressure system is 
damaged, with the aim to 
limit the fuel damage, 

e) Components of the 
residual heat removal 
system during the normal 
and abnormal operation 
and under the accident 
conditions, without the 
loss of the RCPB's 
integrity, 

f) Components necessary 
for the prevention of 
radioactive leakage from 
the containment during 
the accident and post¬ 
accident conditions, 

g) Components necessary 
to limit the ionising 
radiation penetration 
outside the containment, 
during and after the 

2 

Equipment and components of 
systems carrying reactor 
coolant that are not safety class 

1 and to equipment and 
components required to ensure 
containment of radioactivity in 
the event of a LOCA. This 
includes: 

a) Equipment and 
components that are not 
safety class 1; 

b) Main equipment and 
components of the following 
systems: RHRS, CVCS, 
ECCS, CSS; 

c) Equipment and 
components that constitute 
the third barrier: the reactor 
containment and the 
associated isolation 
systems, portions of 
secondary systems inside 
the reactor building up to 
and including the first 
isolation valve located 
outside the reactor building, 
containment hydrogen 
control system, equipment 
and components of the in- 
core instrumentation 
system up to and including 
the manual isolation valve. 

2 and 

3 

Piping and piping 

components that are not 
part of the RCPB but have a 
certain significance with 
respect to reactor safety: 

a) The component is 
required for the 
mitigation of DBAs with 
respect to shut down, 
long-term maintenance 
of subcriticality, and 
decay heat removal. 

Requirements regarding 
components of systems 
which only indirectly serve 
in residual heat removal - 
these are the non¬ 
radioactivity retaining closed 
cooling water systems and 
service water systems - 
shall be specified on a 
plant-specific basis taking 
the design redundancy (e.g. 
redundancy, diversity) into 
consideration. 

b) Large energies are 
released in case of 
failure of the plant 
component and no 
mitigating measures 
such as structural 
measures, spatial 
separation or other 
safety measures are 
available to keep the 
effects of the failure to 
an acceptable limit with 
respect to nuclear 
safety. 

c) A failure of the plant 
component could either 
directly or indirectly 
through a chain of 
assumed sequential 
events, lead to a DBA. 

d) Systems and 
components to which 
none of criteria a) 

SK-2 

• Reactor cooling 
and emergency 
cooling; 

• Residual heat 
removal from 
reactor, 

containment, and 
SGs; 

• Cooling of RCS in 
the cold 
depressurised 
state; 

• All reactor shut 
down functions and 
functions to 
maintain 
subcriticality; 

• Safety functions of 
primary 
containment 
systems; 

• Components to 
maintain 

subcriticality in the 
fuel element 
storage; 

• BWR: Main steam 
and feed water line 
between second 
isolation valve and 
next remote control 
isolation valve; 

• PWR: Secondary 
side of SG up to 
isolation valve 
outside primary 
containment; 

• Components that 
could cause a dose 
limit violation 
according to HSK- 
R-11 
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USA/ASME Section III 2 
ass I Definition 


Canada 

(CSA N285.0-95) 
Class I Definition 


3 Cooling water and 
auxiliary feedwater 
systems or portions 
of these systems 
important to safety 
that are designed for 

1) emergency core 
cooling, 

2) post-accident 
containment heat 
removal, 

3) post-accident 
containment 
atmosphere 
clean-up, or 

4) residual heat 
removal from 
reactor and from 
the spent fuel 
storage pool 
(including primary 
and secondary 
cooling systems). 

Portions of these 
systems that are 
required for their 
safety functions and 
that 

1) do not operate 
during any mode 
of normal reactor 
operation and 

2) cannot be tested 
adequately 
should be 
classified as 
Class 2. 


Pipe diameter > DN20; 
Sections of systems, 
not classified as Class 
1 or 2, that contain 
radioactive substances 
with a tritium 
concentration 
exceeding 0.4 TBq/kg 
(0.01 Ci/g), or an 

energy-weighted 
activity concentration of 
radionuclides 
exceeding that of 0.4 
TBg/kg of Tritium. 


Czech Republic 
(Regulation 214/1997 Sb) 

Class Definition 

accident conditions, 

h) Components necessary 
to accomplish the safety 
functions for the power 
supply or for the control 
of other components 
ranked as the safety 

_ class 2, _ 

3 a) Components necessary 
to prevent the 
unallowable transient 
processes connected 
with the reactivity 
changes, 

b) Components necessary 
to maintain the nuclear 
reactor in the safe 
shutdown conditions, 

c) Components necessary 
to maintain sufficient 
reactor coolant inventory 
for the core cooling 
during the normal and 
abnormal operation, 

d) Components necessary 
to remove heat from the 
safety systems to the 
first accumulating 
volume, which is 
sufficient from the 
viewpoint of performance 
of safety functions, 

e) Components necessary 
to maintain the radiation 
exposure of population 
and of nuclear 
installation personnel 
below the established 
limits, during the 
accident conditions 
connected with the 
leakage of radioactive 
substances and ionising 
radiation from the 
sources located outside 
the containment, and 
after such conditions, 
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France (RRC-P 900 R.4) 

Germany (KTA 3201/3211) 

Switzerland (ENSI-GOI/d) 

Class 

Definition 

Class 

Definition 

Class 

Definition 




through c) apply, the 
failure of which, 
however, would lead to 
major plant internal 
damage. 



3 

Safety Class 3 includes: 

a) CVCS equipment and 
components required for 
the purification of the 
reactor coolant water and 
the boron make-up system 
and equipment; 

b) S/G AFWS equipment and 
components located 
outside reactor 
containment; 

c) CCWS and ESWS 
equipment and 
components; 

d) Reactor cavity and spent 
fuel pit cooling and 
treatment system 
equipment and 
components; 

e) Radioactive waste 
treatment systems 
equipment and components 
whose failure could cause 
release of radioactive 
gases normally stored for 
decay. 


See “2 and 3” above 

SK-3 

• Systems for 
leakage and seal 
water in the 
primary 
containment; 

• Cooling of fuel 
element storage 
pool; 

• Systems for 
gaseous 

radioactive media; 

. RWCUofBWR 
(typically SK-1 and 
3), CVCS of PWR 
(typically SK-2 and 
3); 

• Auxiliary systems 
for SK-1 through 3 
components and 

1E classified 

electrical 

equipment; 

• Systems for 
accident mitigation 
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USA /ASME Section III 2 

Canada 

(CSA N285.0-95) 

Czech Republic 
(Regulation 214/1997 Sb) 

France (RRC-P 900 R.4) 

Germany (KTA 3201/3211) 

Switzerland (ENSI-GOI/d) 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 






f) Components requisite to 
maintain such 
environmental conditions 
inside the nuclear 
installation that are 
necessary for the 
operation of safety 
systems and for the 
access of the personnel 
to perform the important 
activities related to 
safety, 

g) Components necessary 
to prevent the radioactive 
leakage from the 
irradiated fuel that is 
transported or stored 
within the nuclear 
installation, out of the 
core cooling system 
during all states of 
normal and abnormal 
operation, 

h) Components necessary 
to remove fission heat 
from the irradiated fuel 
stored within the nuclear 
installation, out of the 
core cooling system, 

i) Components requisite to 
maintain sufficient 
subcriticality of fuel 
stored within the nuclear 
installation, out of the 
core cooling system, 

j) Components requisite to 
limit the effluents or the 
leakage of solid, liquid or 
gaseous radioactive 
substances and ionising 
radiation below the 
established limiting 
values during all states 
of normal and abnormal 
operation, 

k) Components requisite to 
perform the safety 
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USA/ASME Section III 2 

Canada 

(CSA N285.0-95) 

Czech Republic 
(Regulation 214/1997 Sb) 

France (RRC-P 900 R.4) 

Germany (KTA 3201/3211) 

Switzerland (ENSI-GOI/d) 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 

Class 

Definition 






functions related to the 
power supply or to the 
control of other 
components ranked as 
the safety class 3, 

l) Components requisite to 
perform the safety 
functions for the 
assurance of functional 
capability of other 
components ranked as 
the safety classes 1,2 
and 3, that are not 
related to the control or 
to the power supply, 

m) Components necessary 
for prevention or 
mitigation of the 
consequences of failures 
of the other components 
or constructions of safety 
systems ranked as the 
safety classes 1,2 and 

3. 
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